PolicyKit EU consent capture MVP

Requirements: Node >=22, installed Chromium, npm install. No hosted browser service.
Set CHROME_PATH to your Chromium executable (not a browser debugging port).
Save jobs.json as an array of 1–5 jobs, one page per distinct domain:
[{"url":"https://example.com","acceptSelector":"#accept-all","allowedOrigins":["https://www.google-analytics.com"]}]
The selector must match exactly one visible accept button. List exact authorized
HTTP(S) origins required by the site. Unlisted requests are blocked, so missing
origins make the result incomplete. Inspect the blocked request count.

Only run after obtaining the site's owner's written authorization, verifying its
terms permit the scan and inspecting robots.txt. The tool enforces robots.txt for
the target page and permitted third-party origin roots. No login, forms, bypass,
recursive crawling, continuous monitoring or uploading.

CHROME_PATH=/path/to/chrome node consent.js jobs.json report.json --authorized

Output: report.json and report.json.html, created exclusively with private file
permissions. Existing files are not overwritten. The batch fails if any capture
fails; no partial batch is exported. Keep/delete your files locally.

One fresh profile per site, JavaScript executed, three seconds before the explicit
button click and three seconds after. Before includes navigation; after contains
only requests after the click, not cumulative navigation. Cookies are snapshots.
Cookie values, request paths/queries/headers and bodies are omitted. Cookie names,
domains and paths may still identify site structure: review before sharing.

Limitations: public HTTP(S), default ports only; DNS pinned for listed hosts,
other hosts blocked. GET/HEAD only; POST, service workers, WebSockets, unlisted
origins and downloads are blocked. Sites using these features will be incomplete.
Tracker recognition is a small heuristic domain list, not a compliance verdict;
unknown origins and cookie purposes/retention need manual review. No reject or
withdrawal journey, cross-country emulation or delayed-tracker guarantees. Output
reflects the operator's location/network/browser and observation time only.

Proposed managed report: EUR99 for up to 5 domains, one time. Sales blocked pending
fiscal/commercial verification and matching EUR checkout/delivery/refund tests.
The local MVP tool is available without payment while that gate is closed.
Support: suporte@lgpd.rohnelt.dev
