privalint 0.2.0 → 0.4.0

package/README.de.md

@@ -22,8 +22,8 @@ npx privalint https://ihre-seite.de --lang de
 
 ## Deutschland, Österreich, Schweiz
 
-Mit `--region` wählen Sie, nach welchem Recht privalint die Befunde einordnet. Jeder Befund nennt
-die Rechtsgrundlage des gewählten Landes.
+Mit `--region` wählen Sie das Referenz- und Einstufungsprofil des Tools. Das Profil bestimmt
+nicht, welches Recht für eine Website anwendbar ist. Befunde sind keine rechtliche Beurteilung.
 
 | Region          | Cookies und Tracking                      | Impressum                                       | Besonderheit                                          |
 | --------------- | ----------------------------------------- | ----------------------------------------------- | ----------------------------------------------------- |
@@ -69,6 +69,72 @@ Details, Hintergründe und Lösungen stehen auf Englisch in [`docs/rules`](docs/
 Der Bericht erscheint auf Deutsch in der Zusammenfassung des Workflow-Laufs. Alle Eingaben und
 die Anbindung an GitHub Code Scanning beschreibt die [englische README](README.md#github-action).
 
+Mit `pr-comment: true` wird ein vorhandener Bot-Kommentar aktualisiert oder einmalig erstellt.
+Dafür benötigt der Job `pull-requests: write`. Bei Fork-PRs oder einem schreibgeschützten Token
+wird der Kommentar ohne Scanfehler ausgelassen. Befunde mit einem fehlgeschlagenen Scan-Schritt
+verhindern den Kommentar nicht.
+
+## Konfiguration, Berichtsversion und Fortschritt
+
+Die CLI liest eine vorhandene `privalint.config.json`, alternativ `--config <datei>`.
+CLI-Argumente haben Vorrang. JSON kann URL, Seitenlimit, Sprache, Länderprofil, Ladeoptionen,
+Regel-Schweregrade und eine Anbieter-Freigabeliste enthalten. API-Aufrufer setzen `ruleSettings`
+und `allow` ausdrücklich; `scan()` liest keine Konfigurationsdateien automatisch.
+
+```json
+{
+  "url": "https://example.org",
+  "maxPages": 20,
+  "rules": { "third-party-cdns": "warning", "impressum-link": "off" },
+  "allow": { "vendors": ["Google Analytics"] }
+}
+```
+
+Freigegebene Anbieter bleiben als Hinweise mit Policy-Kennzeichnung sichtbar. Eine Freigabe ist
+kein Nachweis von Einwilligung oder rechtlicher Zulässigkeit. Details stehen in der
+[deutschen Anleitung](docs/configuration.de.md) und der [englischen Fassung](docs/configuration.md).
+
+Neue Berichte enthalten `schemaVersion`, `scannerVersion` und die wirksamen `options`.
+Ohne Schemaversion handelt es sich um einen alten Bericht. `ruleEvaluations[].outcome`
+unterscheidet „Geprüft, kein Befund“, „Befund erkannt“ und „Nicht prüfbar“ mit Begründung.
+`onProgress` liefert tatsächliche Phasen mit verstrichener Zeit und bereinigten Seiten-URLs,
+keinen geschätzten Prozentwert. Die Exit-Code-Policy von CLI/Action bleibt erhalten.
+
+Schema 1.1.0 ergänzt zufällige Scan-/Seiten-IDs und die Zuordnung von Erfassungsversuchen nach
+Redirects. Eigenständige Schemas und Konformitätsbeispiele sind enthalten. Mit
+`--fail-on-incomplete` bzw. Action-Input `fail-on-incomplete: true` wird unvollständige nötige
+Beobachtung optional mit Exit 3 bewertet; Befunde mit Exit 1 haben Vorrang. Bewusst deaktivierte
+Regeln und Consent-Prüfungen sind ausgenommen. Details stehen im
+[Berichtsvertrag](docs/report-contract.de.md) und seiner [englischen Fassung](docs/report-contract.md).
+
+## Öffentliche Webscanner und kontrollierte Erfassung
+
+`scan()` unterstützt einen `networkAdapter` und ein `AbortSignal`. Jeder HTTP-Hop einschließlich
+Redirects durchläuft den Adapter. Er gibt eine Antwort zurück oder lehnt mit einem typisierten
+`NetworkError` ab. Eine Warteschlange puffert Lastspitzen; Parallelität, Anfragemenge,
+Antwortgrößen und Zeitlimits sind getrennt. Im Adapter-Modus gibt es keinen Browser-HTTP-Fallback.
+
+PrivaLint erstellt und schließt Browser sowie frische Contexts selbst, auch bei Abbruch. Der
+Aufrufer verwaltet gemeinsam genutzte Transport-Clients. Die bestehende Egress-Policy muss bei
+jedem Hop DNS-Auflösung und tatsächliche Socket-Ziele kontrollieren und das Request-Signal beachten.
+Die [Anleitung](docs/controlled-scanner.de.md) beschreibt den Vertrag und die Zähler. Ein
+[typgeprüftes Beispiel](examples/controlled-scanner.ts) nutzt ausschließlich vom Betreiber
+freigegebene Origins und festgelegte IP-Adressen.
+
+`findings` enthält ausschließlich Regelbefunde. Technische Einschränkungen stehen getrennt unter
+`pages[].capture.diagnostics`. Bei 48 Anfragen mit 21 blockierten oder fehlgeschlagenen Ressourcen
+bleibt die Erfassung unvollständig, auch wenn keine Findings vorliegen. `ruleEvaluations` zeigt
+pro Seite und Regel `executed`, `skipped` oder `not-evaluable`; `partial: true` kennzeichnet die
+Auswertung verfügbarer positiver Evidenz bei eingeschränkter Beobachtung.
+
+Consent-Zustände unterscheiden „kein Banner erkannt“, „keine unterstützte Ablehnen-Möglichkeit“,
+„Interaktion fehlgeschlagen“ und „Ablehnen getestet“. Fehlende Erkennung allein ist kein
+Datenschutzverstoß. Ein getesteter Klick sagt noch nichts über vollständige Ressourcen-Erfassung aus.
+
+Bestehende CLI-, API- und Action-Aufrufe bleiben gültig. Startseiten-Ladefehler werfen weiterhin
+einen Fehler; `failureMode: 'report'` liefert stattdessen einen strukturierten Bericht und ist im
+Adapter-Modus die Vorgabe. Es werden keine Zusagen rechtlicher Konformität gemacht.
+
 ## Grenzen
 
 - Manche Seiten zeigen ihr Cookie-Banner Headless-Browsern nicht. Dann meldet privalint „kein

package/README.md

@@ -77,19 +77,26 @@ jobs:
 The report shows up in the job summary. With the SARIF upload, findings also appear under
 **Security → Code scanning**.
 
+To create/update a PR comment, set `pr-comment: true` and grant the job `pull-requests: write`.
+The action updates its own marked bot comment. Fork PRs and read-only tokens skip commenting
+without failing the scan. Reports are posted even when findings make the scan step fail.
+See [configuration and report APIs](docs/configuration.md) ([Deutsch](docs/configuration.de.md)).
+
 Scanning a preview deployment instead of production catches problems before they ship. Pass the
 preview URL from your hosting provider's deployment event or action output as `url`.
 
-| Input         | Default           |                                             |
-| ------------- | ----------------- | ------------------------------------------- |
-| `url`         |                   | Page to scan. Required.                     |
-| `max-pages`   | `1`               | How many pages of the same site to crawl.   |
-| `fail-on`     | `error`           | `error`, `warning` or `never`.              |
-| `disable`     |                   | Comma-separated rule ids to skip.           |
-| `lang`        | `en`              | Language of the report: `en` or `de`.       |
-| `region`      | `de`              | Whose law to cite: `de`, `at`, `ch`, `eu`.  |
-| `sarif-file`  | `privalint.sarif` | Where to write SARIF. Empty to skip.        |
-| `job-summary` | `true`            | Add the Markdown report to the job summary. |
+| Input                | Default           |                                                       |
+| -------------------- | ----------------- | ----------------------------------------------------- |
+| `url`                |                   | Page to scan. Required.                               |
+| `max-pages`          | `1`               | How many pages of the same site to crawl.             |
+| `fail-on`            | `error`           | `error`, `warning` or `never`.                        |
+| `fail-on-incomplete` | `false`           | Fail separately for incomplete required observations. |
+| `disable`            |                   | Comma-separated rule ids to skip.                     |
+| `lang`               | `en`              | Language of the report: `en` or `de`.                 |
+| `region`             | `de`              | Whose law to cite: `de`, `at`, `ch`, `eu`.            |
+| `sarif-file`         | `privalint.sarif` | Where to write SARIF. Empty to skip.                  |
+| `job-summary`        | `true`            | Add the Markdown report to the job summary.           |
+| `pr-comment`         | `false`           | Create/update a same-repository PR report comment.    |
 
 Outputs: `exit-code`, and `sarif-file` when a report was written.
 
@@ -113,6 +120,9 @@ privalint <url> [options]
                           Repeatable; .sarif, .json and .md pick their format,
                           other extensions use --format
       --fail-on <level>   error | warning | never (default error)
+      --fail-on-incomplete  Exit 3 for incomplete required observations (opt-in)
+      --allow-incomplete    Override failOnIncomplete from JSON config
+      --config <file>     Select a JSON configuration file
       --disable <rules>   Comma-separated rule ids to skip
       --settle <ms>       Wait this long after load for late tags (default 2000)
       --timeout <ms>      Navigation timeout per page (default 30000)
@@ -126,6 +136,8 @@ privalint <url> [options]
 ```
 
 Exit codes: `0` nothing at or above `--fail-on`, `1` findings, `2` bad arguments or a failed scan.
+With `--fail-on-incomplete`, exit `3` means incomplete required observation. Findings exit `1`
+takes precedence; intentional disabled-rule/consent exclusions are ignored by this gate.
 
 The first run needs a browser. If Playwright hasn't installed one yet:
 
@@ -135,8 +147,8 @@ npx playwright install chromium
 
 ## Countries and languages
 
-The same finding can be a clear violation in one country and a hint in another. `--region` picks
-whose law privalint cites and how strictly it judges:
+`--region` selects the references and severity profile used by the tool. It does not determine
+which law applies to a website, and findings are not legal determinations:
 
 | Region         | Cookies and tracking                 | Imprint                               | Changes                                                                          |
 | -------------- | ------------------------------------ | ------------------------------------- | -------------------------------------------------------------------------------- |
@@ -157,6 +169,20 @@ npx privalint https://ihre-seite.ch --region ch --lang de
 
 ## Use it from code
 
+CLI configuration is loaded from `privalint.config.json` when present, or `--config <file>`.
+CLI flags override JSON settings. API callers pass `ruleSettings` and `allow` explicitly;
+the API never loads a config file implicitly. Allowed vendors remain visible as info with a policy
+annotation; allowlisting does not establish consent or legal approval.
+
+```json
+{
+  "url": "https://example.org",
+  "maxPages": 20,
+  "rules": { "third-party-cdns": "warning", "impressum-link": "off" },
+  "allow": { "vendors": ["Google Analytics"] }
+}
+```
+
 ```ts
 import { scan } from 'privalint';
 
@@ -166,6 +192,44 @@ for (const finding of result.findings) {
 }
 ```
 
+New reports carry `schemaVersion`, `scannerVersion` and normalized `options`. An absent
+schema version means a legacy report, not version 1. `ruleEvaluations[].outcome` explicitly
+distinguishes `checked-no-finding`, `finding-detected` and `not-evaluable`, always with a fixed
+`explanation` code. `onProgress` emits real stages (`starting`, `loading-page`, `checking-consent`,
+`evaluating-rules`, `completed`) with elapsed time and redacted page URLs; it does not invent a
+percentage. The CLI and Action keep their existing finding-threshold exit policy.
+
+Schema 1.1.0 adds random scan/page IDs and explicit capture-to-page progress resolution, so redacted
+pages remain distinguishable. Standalone schemas and complete/partial/skip/policy fixtures are
+included. The [report contract and optional CI gate](docs/report-contract.md)
+([Deutsch](docs/report-contract.de.md)) explain validation and identity/exit-code semantics.
+
+### Public web scanners and controlled capture
+
+`scan()` accepts a `networkAdapter` and `AbortSignal`. The adapter receives each HTTP hop,
+including redirects, and returns a response or throws a typed `NetworkError`. Requests wait
+in a FIFO queue; concurrency, request count, response bytes and timeouts are independent limits.
+There is no browser HTTP fallback in adapter mode.
+
+The scanner owns its browser and fresh contexts and closes them on completion or cancellation.
+The caller owns the adapter's shared clients. Keep your existing egress policy: validate and pin
+DNS/socket destinations for **every** hop, and honour the provided per-request abort signal.
+
+See the [controlled scanner guide](docs/controlled-scanner.md) and the type-checked
+[pinned-transport example](examples/controlled-scanner.ts). The example denies origins absent
+from a trusted deployment allowlist and pins socket addresses; the allowlist must not come from
+the person submitting the scan.
+
+Reports separate `findings` from `pages[].capture.diagnostics`. A page with 48 requests and 21
+blocked/failed requests is marked incomplete even if no findings were produced. Per-page
+`ruleEvaluations` distinguish `executed`, `skipped` and `not-evaluable`; positive evidence may
+still be evaluated with `partial: true`. No banner detected is not itself a privacy finding,
+and does not mean that the reject path was tested.
+
+Existing CLI, API and GitHub Action calls still work. Start-page navigation failures retain the
+legacy throw behaviour unless `failureMode: 'report'` is selected (the default with an adapter).
+No report claims legal compliance.
+
 ## How it works
 
 1. Every page is opened in a **fresh browser context**: no cookies and no storage, the same as a
@@ -206,7 +270,7 @@ for (const finding of result.findings) {
 ## Roadmap
 
 - PR comments from the Action
-- Config file (`privalint.config.ts`) for allowlists and per-rule severity
+- Config migration helpers and report comparison (JSON config is available now)
 - Check the settings layer of banners and the "accept" path
 - More trackers, embeds and consent managers (see the
   [`good first issue`](https://github.com/jexcellence/privalint/labels/good%20first%20issue) label)

package/dist/assessment.d.ts

@@ -0,0 +1,6 @@
+import type { Lang } from './i18n.js';
+import type { Finding, PageSnapshot, Rule, RuleEvaluation } from './types.js';
+export declare function assessPage(page: PageSnapshot, rules: readonly Rule[], siteUrl: URL, lang: Lang, isStart: boolean, consentEnabled: boolean, catalog?: readonly Rule[]): {
+    findings: Finding[];
+    evaluations: RuleEvaluation[];
+};

package/dist/assessment.js

@@ -0,0 +1,115 @@
+import { observedRequests } from './observations.js';
+import { defaultRules } from './rules/index.js';
+import { isFirstParty } from './url.js';
+const REQUIREMENTS = {
+    'pre-consent-trackers': ['network'],
+    'google-fonts': ['network'],
+    'third-party-embeds': ['network'],
+    'third-party-cdns': ['network'],
+    'impressum-link': ['document'],
+    'privacy-policy-link': ['document'],
+    'reject-option': ['consent'],
+    'trackers-after-reject': ['after-reject'],
+};
+export function assessPage(page, rules, siteUrl, lang, isStart, consentEnabled, catalog = rules) {
+    const findings = [];
+    const allRules = new Map([...defaultRules, ...catalog].map((rule) => [rule.id, rule]));
+    const selected = new Set(rules.map((rule) => rule.id));
+    const complete = page.capture?.beforeConsentComplete ?? page.capture?.complete ?? page.error === undefined;
+    const validPage = (page.error === undefined || page.capture?.document === true) &&
+        page.status !== null &&
+        page.status < 400 &&
+        isFirstParty(page.finalUrl, siteUrl);
+    const available = {
+        document: validPage && complete && (page.capture?.document ?? true),
+        network: validPage,
+        consent: validPage && page.consent?.bannerFound === true && page.consent.acceptLabel !== undefined,
+        'after-reject': validPage && page.consent?.rejected === true,
+    };
+    const input = {
+        ...page,
+        requests: observedRequests(page.requests),
+        // A preconnect hint is not evidence of an actual connection in an offline adapter context.
+        resourceHints: complete ? page.resourceHints : [],
+        ...(page.consent?.afterReject === undefined
+            ? {}
+            : {
+                consent: {
+                    ...page.consent,
+                    afterReject: {
+                        ...page.consent.afterReject,
+                        requests: observedRequests(page.consent.afterReject.requests),
+                    },
+                },
+            }),
+    };
+    const evaluations = [...allRules.values()].map((rule) => {
+        const requirements = rule.requires ?? REQUIREMENTS[rule.id] ?? ['document'];
+        const consentRule = requirements.some((kind) => kind === 'consent' || kind === 'after-reject');
+        if (!selected.has(rule.id)) {
+            return {
+                ruleId: rule.id,
+                status: 'skipped',
+                reason: 'disabled',
+                partial: false,
+                outcome: 'not-evaluable',
+                explanation: 'disabled',
+                findingCount: 0,
+            };
+        }
+        if (consentRule && (!isStart || !consentEnabled)) {
+            return {
+                ruleId: rule.id,
+                status: 'skipped',
+                reason: !isStart ? 'not-start-page' : 'consent-disabled',
+                partial: false,
+                outcome: 'not-evaluable',
+                explanation: !isStart ? 'not-start-page' : 'consent-disabled',
+                findingCount: 0,
+            };
+        }
+        if (!requirements.every((kind) => available[kind])) {
+            return {
+                ruleId: rule.id,
+                status: 'not-evaluable',
+                reason: 'missing-observation',
+                partial: true,
+                outcome: 'not-evaluable',
+                explanation: requirements.includes('after-reject')
+                    ? (page.consent?.reason ?? 'missing-reject-observation')
+                    : requirements.includes('consent')
+                        ? (page.consent?.reason ?? 'missing-consent-observation')
+                        : 'incomplete-document',
+                findingCount: 0,
+            };
+        }
+        const detected = rule.check({ page: input, siteUrl, lang });
+        findings.push(...detected.map((finding) => ({
+            ...finding,
+            ...(page.pageId === undefined ? {} : { pageId: page.pageId }),
+        })));
+        const partial = requirements.includes('after-reject')
+            ? page.consent?.afterRejectComplete === false
+            : !complete;
+        return {
+            ruleId: rule.id,
+            status: 'executed',
+            partial,
+            outcome: detected.length > 0 ? 'finding-detected' : partial ? 'not-evaluable' : 'checked-no-finding',
+            explanation: detected.length > 0
+                ? 'positive-evidence'
+                : partial
+                    ? 'incomplete-observation'
+                    : 'required-observations-available',
+            findingCount: detected.length,
+        };
+    });
+    return {
+        findings,
+        evaluations: evaluations.map((evaluation) => ({
+            ...evaluation,
+            ...(page.pageId === undefined ? {} : { pageId: page.pageId }),
+        })),
+    };
+}
+//# sourceMappingURL=assessment.js.map

package/dist/assessment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assessment.js","sourceRoot":"","sources":["../src/assessment.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,MAAM,YAAY,GAA+C;IAC/D,sBAAsB,EAAE,CAAC,SAAS,CAAC;IACnC,cAAc,EAAE,CAAC,SAAS,CAAC;IAC3B,oBAAoB,EAAE,CAAC,SAAS,CAAC;IACjC,kBAAkB,EAAE,CAAC,SAAS,CAAC;IAC/B,gBAAgB,EAAE,CAAC,UAAU,CAAC;IAC9B,qBAAqB,EAAE,CAAC,UAAU,CAAC;IACnC,eAAe,EAAE,CAAC,SAAS,CAAC;IAC5B,uBAAuB,EAAE,CAAC,cAAc,CAAC;CAC1C,CAAC;AAEF,MAAM,UAAU,UAAU,CACxB,IAAkB,EAClB,KAAsB,EACtB,OAAY,EACZ,IAAU,EACV,OAAgB,EAChB,cAAuB,EACvB,OAAO,GAAoB,KAAK;IAEhC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,YAAY,EAAE,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACvF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACvD,MAAM,QAAQ,GACZ,IAAI,CAAC,OAAO,EAAE,qBAAqB,IAAI,IAAI,CAAC,OAAO,EAAE,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC;IAC5F,MAAM,SAAS,GACb,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,QAAQ,KAAK,IAAI,CAAC;QAC7D,IAAI,CAAC,MAAM,KAAK,IAAI;QACpB,IAAI,CAAC,MAAM,GAAG,GAAG;QACjB,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvC,MAAM,SAAS,GAAqC;QAClD,QAAQ,EAAE,SAAS,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,IAAI,IAAI,CAAC;QACnE,OAAO,EAAE,SAAS;QAClB,OAAO,EACL,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,WAAW,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS;QAC3F,cAAc,EAAE,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,QAAQ,KAAK,IAAI;KAC7D,CAAC;IACF,MAAM,KAAK,GAAiB;QAC1B,GAAG,IAAI;QACP,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC;QACzC,2FAA2F;QAC3F,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;QACjD,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,KAAK,SAAS;YACzC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,OAAO,EAAE;oBACP,GAAG,IAAI,CAAC,OAAO;oBACf,WAAW,EAAE;wBACX,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW;wBAC3B,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC;qBAC9D;iBACF;aACF,CAAC;KACP,CAAC;IACF,MAAM,WAAW,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAkB,EAAE;QACtE,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5E,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,cAAc,CAAC,CAAC;QAC/F,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,UAAU;gBAClB,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,eAAe;gBACxB,WAAW,EAAE,UAAU;gBACvB,YAAY,EAAE,CAAC;aAChB,CAAC;QACJ,CAAC;QACD,IAAI,WAAW,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YACjD,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,kBAAkB;gBACxD,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,eAAe;gBACxB,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,kBAAkB;gBAC7D,YAAY,EAAE,CAAC;aAChB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACnD,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,MAAM,EAAE,eAAe;gBACvB,MAAM,EAAE,qBAAqB;gBAC7B,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,eAAe;gBACxB,WAAW,EAAE,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC;oBAChD,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,4BAA4B,CAAC;oBACxD,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC;wBAChC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,6BAA6B,CAAC;wBACzD,CAAC,CAAC,qBAAqB;gBAC3B,YAAY,EAAE,CAAC;aAChB,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,QAAQ,CAAC,IAAI,CACX,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC5B,GAAG,OAAO;YACV,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;SAC9D,CAAC,CAAC,CACJ,CAAC;QACF,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC;YACnD,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,mBAAmB,KAAK,KAAK;YAC7C,CAAC,CAAC,CAAC,QAAQ,CAAC;QACd,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,MAAM,EAAE,UAAU;YAClB,OAAO;YACP,OAAO,EACL,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,oBAAoB;YAC7F,WAAW,EACT,QAAQ,CAAC,MAAM,GAAG,CAAC;gBACjB,CAAC,CAAC,mBAAmB;gBACrB,CAAC,CAAC,OAAO;oBACP,CAAC,CAAC,wBAAwB;oBAC1B,CAAC,CAAC,iCAAiC;YACzC,YAAY,EAAE,QAAQ,CAAC,MAAM;SAC9B,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO;QACL,QAAQ;QACR,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAC5C,GAAG,UAAU;YACb,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;SAC9D,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC"}

package/dist/capture.d.ts

@@ -0,0 +1,5 @@
+import type { Browser } from 'playwright';
+import { type ScanOptions } from './scan-options.js';
+import type { PageSnapshot } from './types.js';
+/** Always owns and closes its context. Each crawl page starts without cookies/storage. */
+export declare function capturePage(browser: Browser, url: string, siteUrl: URL, options: ScanOptions, checkConsent: boolean): Promise<PageSnapshot>;

package/dist/capture.js

@@ -0,0 +1,162 @@
+import { observeConsent } from './consent.js';
+import { classifyLoadError, Diagnostics, diagnosticUrl } from './diagnostics.js';
+import { ControlledNetwork, networkLimits } from './network.js';
+import { DEFAULTS } from './scan-options.js';
+import { isFirstParty } from './url.js';
+/** Always owns and closes its context. Each crawl page starts without cookies/storage. */
+export async function capturePage(browser, url, siteUrl, options, checkConsent) {
+    const controlled = options.networkAdapter !== undefined;
+    const context = await browser.newContext({
+        locale: options.locale ?? DEFAULTS.locale,
+        serviceWorkers: controlled ? 'block' : 'allow',
+        // fulfill() works offline. Unhandled browser HTTP traffic has no network fallback.
+        offline: controlled,
+    });
+    const controller = new AbortController();
+    const captureMs = options.captureTimeoutMs ?? (controlled ? 60_000 : undefined);
+    const deadline = captureMs === undefined ? undefined : AbortSignal.timeout(captureMs);
+    const signal = AbortSignal.any([
+        controller.signal,
+        ...(options.signal ? [options.signal] : []),
+        ...(deadline ? [deadline] : []),
+    ]);
+    const diagnostics = new Diagnostics(options.maxDiagnostics ?? 100, controlled ? networkLimits(options.networkLimits).maxRequests : 5_000);
+    const requests = [];
+    diagnostics.attach(context, requests);
+    const network = options.networkAdapter
+        ? new ControlledNetwork(options.networkAdapter, networkLimits(options.networkLimits), diagnostics, signal)
+        : undefined;
+    let closing;
+    const closeOnAbort = () => {
+        closing ??= context.close().catch(() => { });
+    };
+    signal.addEventListener('abort', closeOnAbort, { once: true });
+    const snapshot = {
+        url,
+        finalUrl: url,
+        status: null,
+        requests: [],
+        cookies: [],
+        links: [],
+        resourceHints: [],
+    };
+    let document = false;
+    let beforeComplete = false;
+    try {
+        if (signal.aborted)
+            closeOnAbort();
+        await network?.attach(context);
+        if (options.offline) {
+            await context.route('**/*', (route) => isFirstParty(route.request().url(), siteUrl)
+                ? route.continue()
+                : route.fulfill({ status: 200, body: '' }));
+        }
+        const page = await context.newPage();
+        await network?.attachPage(page);
+        const response = await page.goto(url, {
+            waitUntil: 'load',
+            timeout: options.timeoutMs ?? DEFAULTS.timeoutMs,
+        });
+        snapshot.finalUrl = page.url();
+        snapshot.status = response?.status() ?? null;
+        await page
+            .waitForLoadState('networkidle', {
+            timeout: options.timeoutMs ?? DEFAULTS.timeoutMs,
+        })
+            .catch(() => diagnostics.add('timeout', page.url()));
+        await page.waitForTimeout(options.settleMs ?? DEFAULTS.settleMs);
+        snapshot.links = await page.$$eval('a[href]', (anchors) => anchors.map((a) => ({
+            href: a.href,
+            text: [a.textContent, a.getAttribute('aria-label'), a.getAttribute('title')]
+                .filter(Boolean)
+                .join(' ')
+                .replace(/\s+/g, ' ')
+                .trim()
+                .slice(0, 200),
+        })));
+        snapshot.resourceHints = await page.$$eval('link[rel][href]', (elements) => elements.map((link) => ({
+            rel: (link.getAttribute('rel') ?? '').toLowerCase(),
+            href: link.href,
+        })));
+        // Offline adapter contexts cannot prove a connection from a preconnect hint alone.
+        if (controlled)
+            snapshot.resourceHints = [];
+        snapshot.cookies = (await context.cookies()).map(({ name, domain, path, expires }) => ({
+            name,
+            domain,
+            path,
+            expires,
+        }));
+        snapshot.requests = [...requests];
+        snapshot.requestCount = diagnostics.data.requests;
+        document = true;
+        beforeComplete = diagnostics.data.issueCount === 0 && snapshot.error === undefined;
+        if (checkConsent && options.consentCheck !== false) {
+            options.onProgress?.({
+                stage: 'checking-consent',
+                elapsedMs: 0,
+                pageUrl: diagnosticUrl(url),
+            });
+            snapshot.consent = await observeConsent(page, context, requests, {
+                settleMs: options.settleMs ?? DEFAULTS.settleMs,
+                timeoutMs: options.timeoutMs ?? DEFAULTS.timeoutMs,
+                signal,
+                onReject: () => {
+                    diagnostics.phase = 'after-reject';
+                },
+                onTimeout: () => diagnostics.add('timeout', page.url()),
+            });
+            if (signal.aborted)
+                throw new DOMException('Capture ended', 'AbortError');
+            if (snapshot.consent.error && !diagnostics.hasIssues('after-reject')) {
+                diagnostics.add(classifyLoadError(snapshot.consent.error), page.url());
+            }
+        }
+    }
+    catch (error) {
+        if (snapshot.requests.length === 0)
+            snapshot.requests = [...requests];
+        snapshot.requestCount ??= diagnostics.data.requests;
+        const kind = signal.aborted
+            ? options.signal?.aborted
+                ? 'aborted'
+                : 'timeout'
+            : classifyLoadError(error);
+        snapshot.error = kind;
+        if (diagnostics.data.issueCount === 0)
+            diagnostics.add(kind, url);
+        if (checkConsent &&
+            options.consentCheck !== false &&
+            (snapshot.consent === undefined || signal.aborted)) {
+            snapshot.consent = {
+                ...snapshot.consent,
+                bannerFound: snapshot.consent?.bannerFound ?? false,
+                rejected: false,
+                state: 'interaction-failed',
+                outcome: 'interaction-failed',
+                reason: 'browser-interaction-failed',
+                error: kind,
+            };
+        }
+    }
+    finally {
+        diagnostics.stop();
+        controller.abort();
+        signal.removeEventListener('abort', closeOnAbort);
+        await Promise.all([closing ?? context.close(), network?.close()]);
+    }
+    if (options.signal?.aborted)
+        throw new DOMException('Scan aborted', 'AbortError');
+    beforeComplete = beforeComplete && !diagnostics.hasIssues('before-consent');
+    if (snapshot.consent?.rejected) {
+        snapshot.consent.afterRejectComplete = !diagnostics.hasIssues('after-reject');
+    }
+    snapshot.capture = {
+        complete: beforeComplete && diagnostics.data.issueCount === 0,
+        beforeConsentComplete: beforeComplete,
+        document,
+        diagnostics: diagnostics.data,
+    };
+    return snapshot;
+}
+//# sourceMappingURL=capture.js.map

package/dist/capture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capture.js","sourceRoot":"","sources":["../src/capture.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAoB,MAAM,mBAAmB,CAAC;AAE/D,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAgB,EAChB,GAAW,EACX,OAAY,EACZ,OAAoB,EACpB,YAAqB;IAErB,MAAM,UAAU,GAAG,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC;IACxD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;QACvC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM;QACzC,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;QAC9C,mFAAmF;QACnF,OAAO,EAAE,UAAU;KACpB,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC;QAC7B,UAAU,CAAC,MAAM;QACjB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAChC,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,IAAI,WAAW,CACjC,OAAO,CAAC,cAAc,IAAI,GAAG,EAC7B,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CACtE,CAAC;IACF,MAAM,QAAQ,GAA6B,EAAE,CAAC;IAC9C,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc;QACpC,CAAC,CAAC,IAAI,iBAAiB,CACnB,OAAO,CAAC,cAAc,EACtB,aAAa,CAAC,OAAO,CAAC,aAAa,CAAC,EACpC,WAAW,EACX,MAAM,CACP;QACH,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,OAAkC,CAAC;IACvC,MAAM,YAAY,GAAG,GAAG,EAAE;QACxB,OAAO,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC;IACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAiB;QAC7B,GAAG;QACH,QAAQ,EAAE,GAAG;QACb,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,EAAE;QACX,KAAK,EAAE,EAAE;QACT,aAAa,EAAE,EAAE;KAClB,CAAC;IACF,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,OAAO;YAAE,YAAY,EAAE,CAAC;QACnC,MAAM,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/B,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CACpC,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC;gBAC1C,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;gBAClB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAC7C,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;YACpC,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS;SACjD,CAAC,CAAC;QACH,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/B,QAAQ,CAAC,MAAM,GAAG,QAAQ,EAAE,MAAM,EAAE,IAAI,IAAI,CAAC;QAC7C,MAAM,IAAI;aACP,gBAAgB,CAAC,aAAa,EAAE;YAC/B,OAAO,EAAE,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS;SACjD,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACvD,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjE,QAAQ,CAAC,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CACxD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClB,IAAI,EAAG,CAAuB,CAAC,IAAI;YACnC,IAAI,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;iBACzE,MAAM,CAAC,OAAO,CAAC;iBACf,IAAI,CAAC,GAAG,CAAC;iBACT,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;iBACpB,IAAI,EAAE;iBACN,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACjB,CAAC,CAAC,CACJ,CAAC;QACF,QAAQ,CAAC,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,QAAQ,EAAE,EAAE,CACzE,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACtB,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;YACnD,IAAI,EAAG,IAAwB,CAAC,IAAI;SACrC,CAAC,CAAC,CACJ,CAAC;QACF,mFAAmF;QACnF,IAAI,UAAU;YAAE,QAAQ,CAAC,aAAa,GAAG,EAAE,CAAC;QAC5C,QAAQ,CAAC,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;YACrF,IAAI;YACJ,MAAM;YACN,IAAI;YACJ,OAAO;SACR,CAAC,CAAC,CAAC;QACJ,QAAQ,CAAC,QAAQ,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;QAClC,QAAQ,CAAC,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;QAClD,QAAQ,GAAG,IAAI,CAAC;QAChB,cAAc,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC;QACnF,IAAI,YAAY,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;YACnD,OAAO,CAAC,UAAU,EAAE,CAAC;gBACnB,KAAK,EAAE,kBAAkB;gBACzB,SAAS,EAAE,CAAC;gBACZ,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC;aAC5B,CAAC,CAAC;YACH,QAAQ,CAAC,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE;gBAC/D,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ;gBAC/C,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS;gBAClD,MAAM;gBACN,QAAQ,EAAE,GAAG,EAAE;oBACb,WAAW,CAAC,KAAK,GAAG,cAAc,CAAC;gBACrC,CAAC;gBACD,SAAS,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aACxD,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;YAC1E,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,CAAC;gBACrE,WAAW,CAAC,GAAG,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,QAAQ,CAAC,QAAQ,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;QACtE,QAAQ,CAAC,YAAY,KAAK,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;QACpD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO;YACzB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO;gBACvB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,SAAS;YACb,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC7B,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC;QACtB,IAAI,WAAW,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC;YAAE,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAClE,IACE,YAAY;YACZ,OAAO,CAAC,YAAY,KAAK,KAAK;YAC9B,CAAC,QAAQ,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,EAClD,CAAC;YACD,QAAQ,CAAC,OAAO,GAAG;gBACjB,GAAG,QAAQ,CAAC,OAAO;gBACnB,WAAW,EAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,IAAI,KAAK;gBACnD,QAAQ,EAAE,KAAK;gBACf,KAAK,EAAE,oBAAoB;gBAC3B,OAAO,EAAE,oBAAoB;gBAC7B,MAAM,EAAE,4BAA4B;gBACpC,KAAK,EAAE,IAAI;aACZ,CAAC;QACJ,CAAC;IACH,CAAC;YAAS,CAAC;QACT,WAAW,CAAC,IAAI,EAAE,CAAC;QACnB,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAClD,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;QAAE,MAAM,IAAI,YAAY,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;IAClF,cAAc,GAAG,cAAc,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC5E,IAAI,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;QAC/B,QAAQ,CAAC,OAAO,CAAC,mBAAmB,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAChF,CAAC;IACD,QAAQ,CAAC,OAAO,GAAG;QACjB,QAAQ,EAAE,cAAc,IAAI,WAAW,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC;QAC7D,qBAAqB,EAAE,cAAc;QACrC,QAAQ;QACR,WAAW,EAAE,WAAW,CAAC,IAAI;KAC9B,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC"}