@actuate-media/cms-core 0.85.3 → 0.87.0

package/dist/script-tags/resolve.js

@@ -1,4 +1,11 @@
 export const SCRIPT_TAGS_CACHE_TAG = 'actuate:script-tags';
+export const SCRIPT_TAG_CONSENT_CATEGORIES = [
+    'none',
+    'analytics',
+    'marketing',
+    'functional',
+    'preferences',
+];
 const EMPTY = { head: [], body_open: [], body_close: [] };
 export function normalizeScriptTagPath(pathParam) {
     const trimmed = pathParam.trim() || '/';
@@ -7,11 +14,64 @@ export function normalizeScriptTagPath(pathParam) {
 function hasScriptTagModel(db) {
     return typeof db.scriptTag?.findMany === 'function';
 }
+/**
+ * Add `async` to external `<script src>` tags that don't already declare
+ * `async` or `defer`. Inline scripts are left untouched — `async` only has
+ * meaning for external scripts.
+ */
+export function applyAsyncToScriptCode(code) {
+    return code.replace(/<script(\s[^>]*)?>/gi, (match, attrs) => {
+        const attrText = attrs ?? '';
+        if (!/\bsrc\s*=/i.test(attrText))
+            return match;
+        if (/\basync\b/i.test(attrText) || /\bdefer\b/i.test(attrText))
+            return match;
+        return `<script async${attrText}>`;
+    });
+}
+/**
+ * Wrap a snippet in a consent gate keyed to `@actuate-media/plugin-consent`
+ * storage (`am_cookie_consent`) and its `am-consent` event. The original
+ * snippet is injected only after the visitor grants full consent.
+ *
+ * Interim category model: the consent plugin currently stores a binary level
+ * (`all` | `essential`), so every non-`none` category requires `all`. The
+ * category is preserved as a `data-consent-category` marker for CMPs and for
+ * future granular gating.
+ */
+export function wrapCodeInConsentGate(code, category) {
+    // \u003C-escape so the payload can never terminate the wrapper script early.
+    const payload = JSON.stringify(code).replace(/</g, '\\u003C');
+    return (`<script data-consent-category="${category}">` +
+        '(function(){' +
+        `var p=${payload};` +
+        // currentScript is only defined during synchronous execution — capture it
+        // now so deferred injection (after the am-consent event) keeps placement.
+        'var s=document.currentScript;' +
+        'function g(){try{return window.localStorage.getItem("am_cookie_consent")==="all"}catch(e){return false}}' +
+        'var d=false;' +
+        'function i(){if(d)return;d=true;' +
+        'var f=document.createRange().createContextualFragment(p);' +
+        'if(s&&s.parentNode){s.parentNode.insertBefore(f,s.nextSibling)}else{document.body.appendChild(f)}}' +
+        'if(g()){i();return}' +
+        'window.addEventListener("am-consent",function(e){if((e.detail&&e.detail.level)==="all")i()});' +
+        '})()' +
+        '</script>');
+}
+function deliverableCode(tag) {
+    let code = tag.code;
+    if (tag.loadAsync)
+        code = applyAsyncToScriptCode(code);
+    const category = tag.consentCategory ?? 'none';
+    if (category !== 'none')
+        code = wrapCodeInConsentGate(code, category);
+    return code;
+}
 /**
  * Resolve enabled script tags for a public URL path, grouped by placement.
  * Shared by the public API route and Next.js site layouts.
  */
-export async function resolveScriptTagsForPath(db, pathParam) {
+export async function resolveScriptTagsForPath(db, pathParam, options = {}) {
     if (!hasScriptTagModel(db))
         return EMPTY;
     const normalizedPath = normalizeScriptTagPath(pathParam);
@@ -21,6 +81,8 @@ export async function resolveScriptTagsForPath(db, pathParam) {
     });
     const matched = [];
     for (const tag of tags) {
+        if (options.preview && tag.disableInPreview !== false)
+            continue;
         if (tag.scope === 'site') {
             matched.push(tag);
             continue;
@@ -49,7 +111,7 @@ export async function resolveScriptTagsForPath(db, pathParam) {
     for (const tag of matched) {
         const bucket = grouped[tag.placement];
         if (bucket)
-            bucket.push(tag.code);
+            bucket.push(deliverableCode(tag));
     }
     return grouped;
 }

package/dist/script-tags/resolve.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/script-tags/resolve.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAA;AAQ1D,MAAM,KAAK,GAAuB,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAA;AAE7E,MAAM,UAAU,sBAAsB,CAAC,SAAiB;IACtD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,CAAA;IACvC,OAAO,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;AAC9C,CAAC;AAED,SAAS,iBAAiB,CAAC,EAAa;IACtC,OAAO,OAAO,EAAE,CAAC,SAAS,EAAE,QAAQ,KAAK,UAAU,CAAA;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,EAAa,EACb,SAAiB;IAEjB,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAA;IAExC,MAAM,cAAc,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAA;IAExD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC;QACvC,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;QACxB,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;KAC7B,CAAC,CAAA;IAEF,MAAM,OAAO,GAA+C,EAAE,CAAA;IAC9D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACjB,SAAQ;QACV,CAAC;QACD,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9D,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrC,MAAM,IAAI,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAA;gBAC3C,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;oBACrE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;oBACjB,MAAK;gBACP,CAAC;YACH,CAAC;YACD,SAAQ;QACV,CAAC;QACD,IAAI,GAAG,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3D,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrC,MAAM,IAAI,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAA;gBAC3C,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;oBAC5B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;oBACjB,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAuB,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAA;IAC/E,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,SAAqC,CAAC,CAAA;QACjE,IAAI,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACnC,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC"}
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/script-tags/resolve.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAA;AAE1D,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,MAAM;IACN,WAAW;IACX,WAAW;IACX,YAAY;IACZ,aAAa;CACL,CAAA;AAkBV,MAAM,KAAK,GAAuB,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAA;AAE7E,MAAM,UAAU,sBAAsB,CAAC,SAAiB;IACtD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,CAAA;IACvC,OAAO,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;AAC9C,CAAC;AAED,SAAS,iBAAiB,CAAC,EAAa;IACtC,OAAO,OAAO,EAAE,CAAC,SAAS,EAAE,QAAQ,KAAK,UAAU,CAAA;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC,KAAK,EAAE,KAAyB,EAAE,EAAE;QAC/E,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE,CAAA;QAC5B,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAA;QAC9C,IAAI,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAA;QAC5E,OAAO,gBAAgB,QAAQ,GAAG,CAAA;IACpC,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,QAAgB;IAClE,6EAA6E;IAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IAC7D,OAAO,CACL,kCAAkC,QAAQ,IAAI;QAC9C,cAAc;QACd,SAAS,OAAO,GAAG;QACnB,0EAA0E;QAC1E,0EAA0E;QAC1E,+BAA+B;QAC/B,0GAA0G;QAC1G,cAAc;QACd,kCAAkC;QAClC,2DAA2D;QAC3D,oGAAoG;QACpG,qBAAqB;QACrB,+FAA+F;QAC/F,MAAM;QACN,WAAW,CACZ,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CAAC,GAIxB;IACC,IAAI,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;IACnB,IAAI,GAAG,CAAC,SAAS;QAAE,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAA;IACtD,MAAM,QAAQ,GAAG,GAAG,CAAC,eAAe,IAAI,MAAM,CAAA;IAC9C,IAAI,QAAQ,KAAK,MAAM;QAAE,IAAI,GAAG,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACrE,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,EAAa,EACb,SAAiB,EACjB,UAAoC,EAAE;IAEtC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAA;IAExC,MAAM,cAAc,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAA;IAExD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC;QACvC,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;QACxB,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;KAC7B,CAAC,CAAA;IAEF,MAAM,OAAO,GAKR,EAAE,CAAA;IACP,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,CAAC,OAAO,IAAI,GAAG,CAAC,gBAAgB,KAAK,KAAK;YAAE,SAAQ;QAC/D,IAAI,GAAG,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACjB,SAAQ;QACV,CAAC;QACD,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9D,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrC,MAAM,IAAI,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAA;gBAC3C,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;oBACrE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;oBACjB,MAAK;gBACP,CAAC;YACH,CAAC;YACD,SAAQ;QACV,CAAC;QACD,IAAI,GAAG,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3D,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrC,MAAM,IAAI,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAA;gBAC3C,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;oBAC5B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;oBACjB,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAuB,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAA;IAC/E,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,SAAqC,CAAC,CAAA;QACjE,IAAI,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAA;IAC/C,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actuate-media/cms-core",
-  "version": "0.85.3",
+  "version": "0.87.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/actuate-media/actuatecms.git",

package/prisma/migrations/0005_script_tag_delivery_controls/migration.sql

@@ -0,0 +1,8 @@
+-- Design-parity delivery controls for script tags:
+--   loadAsync         — inject `async` into external <script src> tags at resolve time
+--   disableInPreview  — skip the tag when rendering inside CMS preview mode
+--   consentCategory   — cookie-consent gate (none | analytics | marketing | functional | preferences)
+ALTER TABLE "actuate_script_tags"
+  ADD COLUMN "loadAsync" BOOLEAN NOT NULL DEFAULT false,
+  ADD COLUMN "disableInPreview" BOOLEAN NOT NULL DEFAULT true,
+  ADD COLUMN "consentCategory" TEXT NOT NULL DEFAULT 'none';

package/prisma/schema.prisma

@@ -867,16 +867,22 @@ model Invite {
 }
 
 model ScriptTag {
-  id          String   @id @default(cuid())
-  name        String
-  code        String   @db.Text
-  placement   String
-  scope       String
-  targetPaths String[]
-  priority    Int      @default(100)
-  enabled     Boolean  @default(true)
-  createdAt   DateTime @default(now())
-  updatedAt   DateTime @updatedAt
+  id               String   @id @default(cuid())
+  name             String
+  code             String   @db.Text
+  placement        String
+  scope            String
+  targetPaths      String[]
+  priority         Int      @default(100)
+  enabled          Boolean  @default(true)
+  /// Inject `async` into external <script src> tags so they don't block render.
+  loadAsync        Boolean  @default(false)
+  /// Skip this tag when the page is rendered inside CMS preview mode.
+  disableInPreview Boolean  @default(true)
+  /// Cookie-consent category gate: none | analytics | marketing | functional | preferences.
+  consentCategory  String   @default("none")
+  createdAt        DateTime @default(now())
+  updatedAt        DateTime @updatedAt
 
   @@index([enabled])
   @@index([placement])