cookiebanner: detect service workers and Cache Storage buckets

A registered service worker is a URL-shaped artifact (origin+path of
the worker script), so it goes in tracker_resources as a new
SERVICE_WORKER resource type. A Cache Storage bucket is an opaque
named string with no URL, so it goes in detected_trackers as a new
CACHE_STORAGE tracker type.

Frontend:
  - StorageDetector wraps caches.open() and enumerates caches.keys()
    on start to surface pre-existing buckets that pre-date the SDK
    load (service workers commonly populate caches eagerly on
    install).
  - ThirdPartyDetector wraps navigator.serviceWorker.register() and
    enumerates getRegistrations() on start.

Both wrappers degrade silently on insecure contexts where these APIs
are unavailable.

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/cmd/tracker-resource/create/create.go

@@ -96,6 +96,7 @@ func NewCmdCreate(f *cmdutil.Factory) *cobra.Command {
 							huh.NewOption("Beacon", "BEACON"),
 							huh.NewOption("Fetch / XHR", "FETCH"),
 							huh.NewOption("Media", "MEDIA"),
+							huh.NewOption("Service Worker", "SERVICE_WORKER"),
 						).
 						Value(&flagResourceType).Run(); err != nil {
 						return err
@@ -161,7 +162,7 @@ func NewCmdCreate(f *cmdutil.Factory) *cobra.Command {
 
 	cmd.Flags().StringVar(&flagCategoryID, "category-id", "", "Cookie category ID (required)")
 	_ = cmd.MarkFlagRequired("category-id")
-	cmd.Flags().StringVar(&flagResourceType, "resource-type", "", "Resource type: SCRIPT, IFRAME, IMAGE, STYLESHEET, FONT, BEACON, FETCH or MEDIA (required)")
+	cmd.Flags().StringVar(&flagResourceType, "resource-type", "", "Resource type: SCRIPT, IFRAME, IMAGE, STYLESHEET, FONT, BEACON, FETCH, MEDIA or SERVICE_WORKER (required)")
 	cmd.Flags().StringVar(&flagOrigin, "origin", "", "Origin URL (required)")
 	cmd.Flags().StringVar(&flagPath, "path", "", "Resource path (required)")
 	cmd.Flags().StringVar(&flagDisplayName, "display-name", "", "Display name (required)")

pkg/coredata/migrations/20260511T064746Z.sql

@@ -0,0 +1,21 @@
+-- Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+--
+-- Permission to use, copy, modify, and/or distribute this software for any
+-- purpose with or without fee is hereby granted, provided that the above
+-- copyright notice and this permission notice appear in all copies.
+--
+-- THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+-- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+-- AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+-- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+-- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+-- OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+-- PERFORMANCE OF THIS SOFTWARE.
+
+-- A registered service worker is a URL-shaped artifact, so it lives
+-- in tracker_resources alongside scripts/iframes.
+ALTER TYPE tracker_resource_type ADD VALUE IF NOT EXISTS 'SERVICE_WORKER';
+
+-- A Cache Storage bucket is just a named string identifier with no
+-- URL, so it lives in detected_trackers like the other storage types.
+ALTER TYPE tracker_type ADD VALUE IF NOT EXISTS 'CACHE_STORAGE';

pkg/coredata/tracker_resource_type.go

@@ -22,14 +22,15 @@ import (
 type TrackerResourceType string
 
 const (
-	TrackerResourceTypeScript     TrackerResourceType = "SCRIPT"
-	TrackerResourceTypeIframe     TrackerResourceType = "IFRAME"
-	TrackerResourceTypeImage      TrackerResourceType = "IMAGE"
-	TrackerResourceTypeStylesheet TrackerResourceType = "STYLESHEET"
-	TrackerResourceTypeFont       TrackerResourceType = "FONT"
-	TrackerResourceTypeBeacon     TrackerResourceType = "BEACON"
-	TrackerResourceTypeFetch      TrackerResourceType = "FETCH"
-	TrackerResourceTypeMedia      TrackerResourceType = "MEDIA"
+	TrackerResourceTypeScript        TrackerResourceType = "SCRIPT"
+	TrackerResourceTypeIframe        TrackerResourceType = "IFRAME"
+	TrackerResourceTypeImage         TrackerResourceType = "IMAGE"
+	TrackerResourceTypeStylesheet    TrackerResourceType = "STYLESHEET"
+	TrackerResourceTypeFont          TrackerResourceType = "FONT"
+	TrackerResourceTypeBeacon        TrackerResourceType = "BEACON"
+	TrackerResourceTypeFetch         TrackerResourceType = "FETCH"
+	TrackerResourceTypeMedia         TrackerResourceType = "MEDIA"
+	TrackerResourceTypeServiceWorker TrackerResourceType = "SERVICE_WORKER"
 )
 
 func TrackerResourceTypes() []TrackerResourceType {
@@ -42,6 +43,7 @@ func TrackerResourceTypes() []TrackerResourceType {
 		TrackerResourceTypeBeacon,
 		TrackerResourceTypeFetch,
 		TrackerResourceTypeMedia,
+		TrackerResourceTypeServiceWorker,
 	}
 }
 
@@ -77,6 +79,8 @@ func (s *TrackerResourceType) Scan(value any) error {
 		*s = TrackerResourceTypeFetch
 	case TrackerResourceTypeMedia:
 		*s = TrackerResourceTypeMedia
+	case TrackerResourceTypeServiceWorker:
+		*s = TrackerResourceTypeServiceWorker
 	default:
 		return fmt.Errorf("invalid TrackerResourceType value: %q", v)
 	}
@@ -92,7 +96,8 @@ func (s TrackerResourceType) Value() (driver.Value, error) {
 		TrackerResourceTypeFont,
 		TrackerResourceTypeBeacon,
 		TrackerResourceTypeFetch,
-		TrackerResourceTypeMedia:
+		TrackerResourceTypeMedia,
+		TrackerResourceTypeServiceWorker:
 		return string(s), nil
 	default:
 		return nil, fmt.Errorf("invalid TrackerResourceType: %s", s)

pkg/coredata/tracker_type.go

@@ -26,6 +26,7 @@ const (
 	TrackerTypeLocalStorage   TrackerType = "LOCAL_STORAGE"
 	TrackerTypeSessionStorage TrackerType = "SESSION_STORAGE"
 	TrackerTypeIndexedDB      TrackerType = "INDEXED_DB"
+	TrackerTypeCacheStorage   TrackerType = "CACHE_STORAGE"
 )
 
 func TrackerTypes() []TrackerType {
@@ -34,6 +35,7 @@ func TrackerTypes() []TrackerType {
 		TrackerTypeLocalStorage,
 		TrackerTypeSessionStorage,
 		TrackerTypeIndexedDB,
+		TrackerTypeCacheStorage,
 	}
 }
 
@@ -61,6 +63,8 @@ func (s *TrackerType) Scan(value any) error {
 		*s = TrackerTypeSessionStorage
 	case TrackerTypeIndexedDB:
 		*s = TrackerTypeIndexedDB
+	case TrackerTypeCacheStorage:
+		*s = TrackerTypeCacheStorage
 	default:
 		return fmt.Errorf("invalid TrackerType value: %q", v)
 	}
@@ -72,7 +76,8 @@ func (s TrackerType) Value() (driver.Value, error) {
 	case TrackerTypeCookie,
 		TrackerTypeLocalStorage,
 		TrackerTypeSessionStorage,
-		TrackerTypeIndexedDB:
+		TrackerTypeIndexedDB,
+		TrackerTypeCacheStorage:
 		return string(s), nil
 	default:
 		return nil, fmt.Errorf("invalid TrackerType: %s", s)

pkg/server/api/console/v1/graphql/cookie_banner.graphql

@@ -52,6 +52,10 @@ enum TrackerType
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.TrackerTypeIndexedDB"
         )
+    CACHE_STORAGE
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.TrackerTypeCacheStorage"
+        )
 }
 
 enum CookieBannerOrderField
@@ -332,6 +336,10 @@ enum TrackerResourceType
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.TrackerResourceTypeMedia"
         )
+    SERVICE_WORKER
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.TrackerResourceTypeServiceWorker"
+        )
 }
 
 enum TrackerResourceOrderField

pkg/server/api/cookiebanner/v1/handler.go

@@ -423,6 +423,8 @@ func (h *Handler) handleReportDetectedTrackers(w http.ResponseWriter, r *http.Re
 			storageType = coredata.TrackerTypeSessionStorage
 		case "indexed_db":
 			storageType = coredata.TrackerTypeIndexedDB
+		case "cache_storage":
+			storageType = coredata.TrackerTypeCacheStorage
 		default:
 			continue
 		}
@@ -457,6 +459,8 @@ func (h *Handler) handleReportDetectedTrackers(w http.ResponseWriter, r *http.Re
 			resourceType = coredata.TrackerResourceTypeFetch
 		case "media":
 			resourceType = coredata.TrackerResourceTypeMedia
+		case "service_worker":
+			resourceType = coredata.TrackerResourceTypeServiceWorker
 		default:
 			continue
 		}

pkg/server/api/mcp/v1/specification.yaml

@@ -9450,7 +9450,7 @@ components:
           description: Cookie category ID
         tracker_type:
           type: string
-          enum: [COOKIE, LOCAL_STORAGE, SESSION_STORAGE, INDEXED_DB]
+          enum: [COOKIE, LOCAL_STORAGE, SESSION_STORAGE, INDEXED_DB, CACHE_STORAGE]
           description: Type of tracker
         pattern:
           type: string
@@ -9522,7 +9522,7 @@ components:
           description: Cookie category ID
         resource_type:
           type: string
-          enum: [SCRIPT, IFRAME, IMAGE, STYLESHEET, FONT, BEACON, FETCH, MEDIA]
+          enum: [SCRIPT, IFRAME, IMAGE, STYLESHEET, FONT, BEACON, FETCH, MEDIA, SERVICE_WORKER]
           description: Type of tracked resource
         origin:
           type: string
@@ -10046,7 +10046,7 @@ components:
           $ref: "#/components/schemas/GID"
         tracker_type:
           type: string
-          enum: [COOKIE, LOCAL_STORAGE, SESSION_STORAGE, INDEXED_DB]
+          enum: [COOKIE, LOCAL_STORAGE, SESSION_STORAGE, INDEXED_DB, CACHE_STORAGE]
         pattern:
           type: string
         match_type:
@@ -10186,7 +10186,7 @@ components:
           $ref: "#/components/schemas/GID"
         resource_type:
           type: string
-          enum: [SCRIPT, IFRAME, IMAGE, STYLESHEET, FONT, BEACON, FETCH, MEDIA]
+          enum: [SCRIPT, IFRAME, IMAGE, STYLESHEET, FONT, BEACON, FETCH, MEDIA, SERVICE_WORKER]
         origin:
           type: string
         path: