cookiebanner: broaden resource detection via PerformanceObserver

ThirdPartyDetector previously only saw <script src> and <iframe src>
because it scanned the DOM and watched mutations. Add a single
PerformanceObserver({type:'resource', buffered:true}) that picks up
everything the browser actually loaded:

  - tracking pixels (<img>, <picture>, srcset)
  - cross-origin stylesheets and web fonts
  - fetch / XHR / sendBeacon / ping calls (SDK call-homes)
  - video, audio, embed, object media

initiatorType is mapped to six new tracker_resource_type enum values
(IMAGE, STYLESHEET, FONT, BEACON, FETCH, MEDIA) and the existing
upsert path in tracker_resources picks them up unchanged.

Closes a real gap with headless cookie scanners: most SDKs phone home
via beacons after their script is gone, and the DOM scan never saw it.

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/cmd/tracker-resource/create/create.go

@@ -90,6 +90,12 @@ func NewCmdCreate(f *cmdutil.Factory) *cobra.Command {
 						Options(
 							huh.NewOption("Script", "SCRIPT"),
 							huh.NewOption("Iframe", "IFRAME"),
+							huh.NewOption("Image", "IMAGE"),
+							huh.NewOption("Stylesheet", "STYLESHEET"),
+							huh.NewOption("Font", "FONT"),
+							huh.NewOption("Beacon", "BEACON"),
+							huh.NewOption("Fetch / XHR", "FETCH"),
+							huh.NewOption("Media", "MEDIA"),
 						).
 						Value(&flagResourceType).Run(); err != nil {
 						return err
@@ -155,7 +161,7 @@ func NewCmdCreate(f *cmdutil.Factory) *cobra.Command {
 
 	cmd.Flags().StringVar(&flagCategoryID, "category-id", "", "Cookie category ID (required)")
 	_ = cmd.MarkFlagRequired("category-id")
-	cmd.Flags().StringVar(&flagResourceType, "resource-type", "", "Resource type: SCRIPT or IFRAME (required)")
+	cmd.Flags().StringVar(&flagResourceType, "resource-type", "", "Resource type: SCRIPT, IFRAME, IMAGE, STYLESHEET, FONT, BEACON, FETCH or MEDIA (required)")
 	cmd.Flags().StringVar(&flagOrigin, "origin", "", "Origin URL (required)")
 	cmd.Flags().StringVar(&flagPath, "path", "", "Resource path (required)")
 	cmd.Flags().StringVar(&flagDisplayName, "display-name", "", "Display name (required)")

pkg/coredata/migrations/20260511T063925Z.sql

@@ -0,0 +1,24 @@
+-- Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+--
+-- Permission to use, copy, modify, and/or distribute this software for any
+-- purpose with or without fee is hereby granted, provided that the above
+-- copyright notice and this permission notice appear in all copies.
+--
+-- THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+-- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+-- AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+-- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+-- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+-- OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+-- PERFORMANCE OF THIS SOFTWARE.
+
+-- Extend tracker_resource_type to cover everything the in-page
+-- PerformanceObserver can attribute: tracking pixels, fetch/XHR
+-- call-homes, beacons, web fonts, cross-origin stylesheets, and
+-- video/audio embeds.
+ALTER TYPE tracker_resource_type ADD VALUE IF NOT EXISTS 'IMAGE';
+ALTER TYPE tracker_resource_type ADD VALUE IF NOT EXISTS 'STYLESHEET';
+ALTER TYPE tracker_resource_type ADD VALUE IF NOT EXISTS 'FONT';
+ALTER TYPE tracker_resource_type ADD VALUE IF NOT EXISTS 'BEACON';
+ALTER TYPE tracker_resource_type ADD VALUE IF NOT EXISTS 'FETCH';
+ALTER TYPE tracker_resource_type ADD VALUE IF NOT EXISTS 'MEDIA';

pkg/coredata/tracker_resource_type.go

@@ -22,14 +22,26 @@ import (
 type TrackerResourceType string
 
 const (
-	TrackerResourceTypeScript TrackerResourceType = "SCRIPT"
-	TrackerResourceTypeIframe TrackerResourceType = "IFRAME"
+	TrackerResourceTypeScript     TrackerResourceType = "SCRIPT"
+	TrackerResourceTypeIframe     TrackerResourceType = "IFRAME"
+	TrackerResourceTypeImage      TrackerResourceType = "IMAGE"
+	TrackerResourceTypeStylesheet TrackerResourceType = "STYLESHEET"
+	TrackerResourceTypeFont       TrackerResourceType = "FONT"
+	TrackerResourceTypeBeacon     TrackerResourceType = "BEACON"
+	TrackerResourceTypeFetch      TrackerResourceType = "FETCH"
+	TrackerResourceTypeMedia      TrackerResourceType = "MEDIA"
 )
 
 func TrackerResourceTypes() []TrackerResourceType {
 	return []TrackerResourceType{
 		TrackerResourceTypeScript,
 		TrackerResourceTypeIframe,
+		TrackerResourceTypeImage,
+		TrackerResourceTypeStylesheet,
+		TrackerResourceTypeFont,
+		TrackerResourceTypeBeacon,
+		TrackerResourceTypeFetch,
+		TrackerResourceTypeMedia,
 	}
 }
 
@@ -53,6 +65,18 @@ func (s *TrackerResourceType) Scan(value any) error {
 		*s = TrackerResourceTypeScript
 	case TrackerResourceTypeIframe:
 		*s = TrackerResourceTypeIframe
+	case TrackerResourceTypeImage:
+		*s = TrackerResourceTypeImage
+	case TrackerResourceTypeStylesheet:
+		*s = TrackerResourceTypeStylesheet
+	case TrackerResourceTypeFont:
+		*s = TrackerResourceTypeFont
+	case TrackerResourceTypeBeacon:
+		*s = TrackerResourceTypeBeacon
+	case TrackerResourceTypeFetch:
+		*s = TrackerResourceTypeFetch
+	case TrackerResourceTypeMedia:
+		*s = TrackerResourceTypeMedia
 	default:
 		return fmt.Errorf("invalid TrackerResourceType value: %q", v)
 	}
@@ -62,7 +86,13 @@ func (s *TrackerResourceType) Scan(value any) error {
 func (s TrackerResourceType) Value() (driver.Value, error) {
 	switch s {
 	case TrackerResourceTypeScript,
-		TrackerResourceTypeIframe:
+		TrackerResourceTypeIframe,
+		TrackerResourceTypeImage,
+		TrackerResourceTypeStylesheet,
+		TrackerResourceTypeFont,
+		TrackerResourceTypeBeacon,
+		TrackerResourceTypeFetch,
+		TrackerResourceTypeMedia:
 		return string(s), nil
 	default:
 		return nil, fmt.Errorf("invalid TrackerResourceType: %s", s)

pkg/server/api/console/v1/graphql/cookie_banner.graphql

@@ -308,6 +308,30 @@ enum TrackerResourceType
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.TrackerResourceTypeIframe"
         )
+    IMAGE
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.TrackerResourceTypeImage"
+        )
+    STYLESHEET
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.TrackerResourceTypeStylesheet"
+        )
+    FONT
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.TrackerResourceTypeFont"
+        )
+    BEACON
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.TrackerResourceTypeBeacon"
+        )
+    FETCH
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.TrackerResourceTypeFetch"
+        )
+    MEDIA
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.TrackerResourceTypeMedia"
+        )
 }
 
 enum TrackerResourceOrderField

pkg/server/api/cookiebanner/v1/handler.go

@@ -445,6 +445,18 @@ func (h *Handler) handleReportDetectedTrackers(w http.ResponseWriter, r *http.Re
 			resourceType = coredata.TrackerResourceTypeScript
 		case "iframe":
 			resourceType = coredata.TrackerResourceTypeIframe
+		case "image":
+			resourceType = coredata.TrackerResourceTypeImage
+		case "stylesheet":
+			resourceType = coredata.TrackerResourceTypeStylesheet
+		case "font":
+			resourceType = coredata.TrackerResourceTypeFont
+		case "beacon":
+			resourceType = coredata.TrackerResourceTypeBeacon
+		case "fetch":
+			resourceType = coredata.TrackerResourceTypeFetch
+		case "media":
+			resourceType = coredata.TrackerResourceTypeMedia
 		default:
 			continue
 		}

pkg/server/api/mcp/v1/specification.yaml

@@ -9522,7 +9522,7 @@ components:
           description: Cookie category ID
         resource_type:
           type: string
-          enum: [SCRIPT, IFRAME]
+          enum: [SCRIPT, IFRAME, IMAGE, STYLESHEET, FONT, BEACON, FETCH, MEDIA]
           description: Type of tracked resource
         origin:
           type: string
@@ -10186,7 +10186,7 @@ components:
           $ref: "#/components/schemas/GID"
         resource_type:
           type: string
-          enum: [SCRIPT, IFRAME]
+          enum: [SCRIPT, IFRAME, IMAGE, STYLESHEET, FONT, BEACON, FETCH, MEDIA]
         origin:
           type: string
         path: