@blotoutio/providers-consentiq-sdk 1.64.0

package/README.md

@@ -0,0 +1,10 @@
+# providers-consentiq-sdk
+
+Browser SDK for the ConsentIQ provider. Collects the visitor's consent decisions
+from the host store's privacy API (and any external CMP) and forwards them to the
+Blotout `consentIQ/save-data` endpoint.
+
+Delivered through the EdgeTag tag's `/load` + `/init` path — the core bundle
+registers the provider, and a per-store adapter (`stores/shopify`) is appended by
+`/load` only for the matching platform. This replaces the standalone ConsentIQ
+Shopify app embed.

package/index.cjs.js

@@ -0,0 +1,96 @@
+'use strict';
+
+const packageName = 'consentIQ';
+
+const canLog = () => {
+    try {
+        return localStorage.getItem('edgeTagDebug') === '1';
+    }
+    catch {
+        return false;
+    }
+};
+const prefix = `[EdgeTag]`;
+const logger = {
+    log: (...args) => {
+        if (canLog()) {
+            console.log(prefix, ...args);
+        }
+    },
+    error: (...args) => {
+        if (canLog()) {
+            console.error(prefix, ...args);
+        }
+    },
+    info: (...args) => {
+        if (canLog()) {
+            console.info(prefix, ...args);
+        }
+    },
+    trace: (...args) => {
+        if (canLog()) {
+            console.trace(prefix, ...args);
+        }
+    },
+};
+
+/**
+ * Global registry key shared across the separately-loaded consentIQ bundles
+ * (core `index` and the per-store adapter). `Symbol.for` resolves to the same
+ * symbol in every bundle, so the store adapter can register its factory here
+ * and the core `init` can read it back.
+ */
+const registryKey = Symbol.for('consentiq');
+
+/**
+ * consentIQ SDK entry point. Runs in the top-level browser window only.
+ *
+ * Resolves the store adapter registered by the per-store bundle (e.g.
+ * stores/shopify) and hands off to its `collectAnalytics`, which forwards the
+ * visitor's consent decisions to the Blotout `save-data` endpoint. When no
+ * adapter is present (platform without a consentIQ store bundle) this is a
+ * no-op.
+ */
+const init = (params) => {
+    var _a, _b, _c, _d, _e;
+    if (typeof window === 'undefined' || typeof document === 'undefined') {
+        // Not a browser (e.g. server-side SDK) — nothing to collect.
+        return;
+    }
+    if (window.top !== window) {
+        // Only collect from the top-level window, never nested iframes.
+        return;
+    }
+    try {
+        const registry = ((_a = window[registryKey]) !== null && _a !== void 0 ? _a : (window[registryKey] = {}));
+        const storeAPI = ((_b = registry.storeAPI) !== null && _b !== void 0 ? _b : (registry.storeAPI = (_c = registry.storeAPIFactory) === null || _c === void 0 ? void 0 : _c.call(registry)));
+        if (!storeAPI) {
+            // No store adapter loaded for this platform — nothing to collect.
+            return;
+        }
+        storeAPI.collectAnalytics({
+            baseUrl: params.baseUrl,
+            isNewSession: (_e = (_d = params.session) === null || _d === void 0 ? void 0 : _d.isNewSession) !== null && _e !== void 0 ? _e : false,
+        });
+    }
+    catch (error) {
+        logger.error('Failed to initialize consentIQ:', error);
+    }
+};
+
+// eslint-disable-next-line @nx/enforce-module-boundaries
+const data = {
+    name: packageName,
+    init,
+};
+try {
+    if (typeof window !== 'undefined') {
+        window.edgetagProviders = window.edgetagProviders || [];
+        window.edgetagProviders.push(data);
+    }
+}
+catch (error) {
+    logger.error('Failed to register consentIQ provider', error);
+}
+
+module.exports = data;

package/index.d.ts

@@ -0,0 +1 @@
+declare module '@blotoutio/providers-consentiq-sdk'

package/index.js

@@ -0,0 +1,99 @@
+var ProvidersConsentiqSdk = (function () {
+    'use strict';
+
+    const packageName = 'consentIQ';
+
+    const canLog = () => {
+        try {
+            return localStorage.getItem('edgeTagDebug') === '1';
+        }
+        catch {
+            return false;
+        }
+    };
+    const prefix = `[EdgeTag]`;
+    const logger = {
+        log: (...args) => {
+            if (canLog()) {
+                console.log(prefix, ...args);
+            }
+        },
+        error: (...args) => {
+            if (canLog()) {
+                console.error(prefix, ...args);
+            }
+        },
+        info: (...args) => {
+            if (canLog()) {
+                console.info(prefix, ...args);
+            }
+        },
+        trace: (...args) => {
+            if (canLog()) {
+                console.trace(prefix, ...args);
+            }
+        },
+    };
+
+    /**
+     * Global registry key shared across the separately-loaded consentIQ bundles
+     * (core `index` and the per-store adapter). `Symbol.for` resolves to the same
+     * symbol in every bundle, so the store adapter can register its factory here
+     * and the core `init` can read it back.
+     */
+    const registryKey = Symbol.for('consentiq');
+
+    /**
+     * consentIQ SDK entry point. Runs in the top-level browser window only.
+     *
+     * Resolves the store adapter registered by the per-store bundle (e.g.
+     * stores/shopify) and hands off to its `collectAnalytics`, which forwards the
+     * visitor's consent decisions to the Blotout `save-data` endpoint. When no
+     * adapter is present (platform without a consentIQ store bundle) this is a
+     * no-op.
+     */
+    const init = (params) => {
+        var _a, _b, _c, _d, _e;
+        if (typeof window === 'undefined' || typeof document === 'undefined') {
+            // Not a browser (e.g. server-side SDK) — nothing to collect.
+            return;
+        }
+        if (window.top !== window) {
+            // Only collect from the top-level window, never nested iframes.
+            return;
+        }
+        try {
+            const registry = ((_a = window[registryKey]) !== null && _a !== void 0 ? _a : (window[registryKey] = {}));
+            const storeAPI = ((_b = registry.storeAPI) !== null && _b !== void 0 ? _b : (registry.storeAPI = (_c = registry.storeAPIFactory) === null || _c === void 0 ? void 0 : _c.call(registry)));
+            if (!storeAPI) {
+                // No store adapter loaded for this platform — nothing to collect.
+                return;
+            }
+            storeAPI.collectAnalytics({
+                baseUrl: params.baseUrl,
+                isNewSession: (_e = (_d = params.session) === null || _d === void 0 ? void 0 : _d.isNewSession) !== null && _e !== void 0 ? _e : false,
+            });
+        }
+        catch (error) {
+            logger.error('Failed to initialize consentIQ:', error);
+        }
+    };
+
+    // eslint-disable-next-line @nx/enforce-module-boundaries
+    const data = {
+        name: packageName,
+        init,
+    };
+    try {
+        if (typeof window !== 'undefined') {
+            window.edgetagProviders = window.edgetagProviders || [];
+            window.edgetagProviders.push(data);
+        }
+    }
+    catch (error) {
+        logger.error('Failed to register consentIQ provider', error);
+    }
+
+    return data;
+
+})();

package/index.mjs

@@ -0,0 +1,94 @@
+const packageName = 'consentIQ';
+
+const canLog = () => {
+    try {
+        return localStorage.getItem('edgeTagDebug') === '1';
+    }
+    catch {
+        return false;
+    }
+};
+const prefix = `[EdgeTag]`;
+const logger = {
+    log: (...args) => {
+        if (canLog()) {
+            console.log(prefix, ...args);
+        }
+    },
+    error: (...args) => {
+        if (canLog()) {
+            console.error(prefix, ...args);
+        }
+    },
+    info: (...args) => {
+        if (canLog()) {
+            console.info(prefix, ...args);
+        }
+    },
+    trace: (...args) => {
+        if (canLog()) {
+            console.trace(prefix, ...args);
+        }
+    },
+};
+
+/**
+ * Global registry key shared across the separately-loaded consentIQ bundles
+ * (core `index` and the per-store adapter). `Symbol.for` resolves to the same
+ * symbol in every bundle, so the store adapter can register its factory here
+ * and the core `init` can read it back.
+ */
+const registryKey = Symbol.for('consentiq');
+
+/**
+ * consentIQ SDK entry point. Runs in the top-level browser window only.
+ *
+ * Resolves the store adapter registered by the per-store bundle (e.g.
+ * stores/shopify) and hands off to its `collectAnalytics`, which forwards the
+ * visitor's consent decisions to the Blotout `save-data` endpoint. When no
+ * adapter is present (platform without a consentIQ store bundle) this is a
+ * no-op.
+ */
+const init = (params) => {
+    var _a, _b, _c, _d, _e;
+    if (typeof window === 'undefined' || typeof document === 'undefined') {
+        // Not a browser (e.g. server-side SDK) — nothing to collect.
+        return;
+    }
+    if (window.top !== window) {
+        // Only collect from the top-level window, never nested iframes.
+        return;
+    }
+    try {
+        const registry = ((_a = window[registryKey]) !== null && _a !== void 0 ? _a : (window[registryKey] = {}));
+        const storeAPI = ((_b = registry.storeAPI) !== null && _b !== void 0 ? _b : (registry.storeAPI = (_c = registry.storeAPIFactory) === null || _c === void 0 ? void 0 : _c.call(registry)));
+        if (!storeAPI) {
+            // No store adapter loaded for this platform — nothing to collect.
+            return;
+        }
+        storeAPI.collectAnalytics({
+            baseUrl: params.baseUrl,
+            isNewSession: (_e = (_d = params.session) === null || _d === void 0 ? void 0 : _d.isNewSession) !== null && _e !== void 0 ? _e : false,
+        });
+    }
+    catch (error) {
+        logger.error('Failed to initialize consentIQ:', error);
+    }
+};
+
+// eslint-disable-next-line @nx/enforce-module-boundaries
+const data = {
+    name: packageName,
+    init,
+};
+try {
+    if (typeof window !== 'undefined') {
+        window.edgetagProviders = window.edgetagProviders || [];
+        window.edgetagProviders.push(data);
+    }
+}
+catch (error) {
+    logger.error('Failed to register consentIQ provider', error);
+}
+
+export { data as default };

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@blotoutio/providers-consentiq-sdk",
+  "version": "1.64.0",
+  "description": "ConsentIQ Browser SDK for EdgeTag",
+  "author": "Blotout",
+  "license": "MIT",
+  "homepage": "https://github.com/blotoutio/edgetag-sdk",
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./index.cjs.js",
+  "module": "./index.mjs",
+  "types": "./index.d.ts",
+  "exports": {
+    ".": {
+      "require": "./index.cjs.js",
+      "import": "./index.mjs",
+      "default": "./index.js"
+    },
+    "./stores/shopify/index.js": {
+      "require": "./stores/shopify/index.cjs.js",
+      "import": "./stores/shopify/index.mjs",
+      "default": "./stores/shopify/index.js"
+    }
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/blotoutio/edgetag-sdk.git"
+  },
+  "files": [
+    "package.json",
+    "README.md",
+    "index.js",
+    "index.cjs.js",
+    "index.mjs",
+    "index.d.ts",
+    "stores/shopify/index.js",
+    "stores/shopify/index.cjs.js",
+    "stores/shopify/index.mjs"
+  ]
+}

package/stores/shopify/index.cjs.js

@@ -0,0 +1,262 @@
+'use strict';
+
+/**
+ * Global registry key shared across the separately-loaded consentIQ bundles
+ * (core `index` and the per-store adapter). `Symbol.for` resolves to the same
+ * symbol in every bundle, so the store adapter can register its factory here
+ * and the core `init` can read it back.
+ */
+const registryKey = Symbol.for('consentiq');
+
+const canLog = () => {
+    try {
+        return localStorage.getItem('edgeTagDebug') === '1';
+    }
+    catch {
+        return false;
+    }
+};
+const prefix = `[EdgeTag]`;
+const logger = {
+    log: (...args) => {
+        if (canLog()) {
+            console.log(prefix, ...args);
+        }
+    },
+    error: (...args) => {
+        if (canLog()) {
+            console.error(prefix, ...args);
+        }
+    },
+    info: (...args) => {
+        if (canLog()) {
+            console.info(prefix, ...args);
+        }
+    },
+    trace: (...args) => {
+        if (canLog()) {
+            console.trace(prefix, ...args);
+        }
+    },
+};
+
+const getOnetrustConsent = () => {
+    try {
+        const name = 'OptanonConsent';
+        const cookie = document.cookie.match(new RegExp('(^| )' + name + '=([^;]+)'));
+        if (cookie && cookie.length > 2) {
+            const match = decodeURIComponent(cookie[2]).match(new RegExp('&groups=([^&]+)'));
+            if (match && match.length > 1) {
+                const data = match[1].split(',');
+                if (!data) {
+                    return null;
+                }
+                return {
+                    analyticsSetting: data.some((g) => g === 'C0002:1' || g === '2:1')
+                        ? 'allowed'
+                        : 'disallowed',
+                    marketingSetting: data.some((g) => g === 'C0004:1' || g === '4:1' || g === 'C0005:1' || g === '5:1')
+                        ? 'allowed'
+                        : 'disallowed',
+                    preferencesSetting: data.some((g) => g === 'C0003:1' || g === '3:1')
+                        ? 'allowed'
+                        : 'disallowed',
+                };
+            }
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+};
+const getOsanoConsent = () => {
+    try {
+        const osano = window.Osano;
+        if (!(osano === null || osano === void 0 ? void 0 : osano.cm)) {
+            return null;
+        }
+        return {
+            analyticsSetting: osano.cm.analytics ? 'allowed' : 'disallowed',
+            marketingSetting: osano.cm.marketing ? 'allowed' : 'disallowed',
+            preferencesSetting: osano.cm.personalization ? 'allowed' : 'disallowed',
+            saleOfDataSetting: osano.cm.optOut ? 'disallowed' : 'allowed',
+        };
+    }
+    catch {
+        return null;
+    }
+};
+const getTermlyConsent = () => {
+    var _a, _b;
+    try {
+        const state = (_b = (_a = window.Termly) === null || _a === void 0 ? void 0 : _a.getConsentState) === null || _b === void 0 ? void 0 : _b.call(_a);
+        if (!state) {
+            return null;
+        }
+        return {
+            analyticsSetting: state.analytics ? 'allowed' : 'disallowed',
+            marketingSetting: state.advertising || state.social_networking ? 'allowed' : 'disallowed',
+            preferencesSetting: state.performance ? 'allowed' : 'disallowed',
+        };
+    }
+    catch {
+        return null;
+    }
+};
+/**
+ * Reads the current decision from a supported external CMP (OneTrust, Osano, or
+ * Termly), if one is present. Applies regardless of host platform and takes
+ * precedence over the platform-derived `*Setting` fields in {@link sendConsentData}.
+ */
+const getConsentSettings = () => {
+    const oneTrustConsent = getOnetrustConsent();
+    if (oneTrustConsent) {
+        return oneTrustConsent;
+    }
+    const osanoConsent = getOsanoConsent();
+    if (osanoConsent) {
+        return osanoConsent;
+    }
+    const termlyConsent = getTermlyConsent();
+    if (termlyConsent) {
+        return termlyConsent;
+    }
+    return {};
+};
+/**
+ * POSTs a consent snapshot to the Blotout backend `consentIQ/save-data`
+ * endpoint. The platform collector builds `body`; an external CMP still wins via
+ * {@link getConsentSettings}. Errors are logged and swallowed so consent capture
+ * never breaks the host page.
+ */
+const sendConsentData = async (baseUrl, body) => {
+    const finalBody = {
+        ...body,
+        analyticsSetting: 'unknown',
+        marketingSetting: 'unknown',
+        preferencesSetting: 'unknown',
+        saleOfDataSetting: 'unknown',
+        // An external CMP (OneTrust/Osano/Termly) wins over the 'unknown' defaults.
+        ...getConsentSettings(),
+    };
+    try {
+        const response = await fetch(`${baseUrl}/providers/consentIQ/save-data`, {
+            method: 'POST',
+            body: JSON.stringify(finalBody),
+            headers: { 'Content-Type': 'application/json' },
+            credentials: 'include',
+        });
+        if (!response.ok) {
+            throw new Error(`save-data returned ${response.status} ${response.statusText}`);
+        }
+    }
+    catch (e) {
+        logger.error('[consentIQ] Failed to send consent data', e);
+    }
+};
+
+const processConsent = (consent) => {
+    if (consent == null) {
+        return 'unknown';
+    }
+    return consent ? '1' : '0';
+};
+// Shopify's boolean helpers (marketingAllowed(), etc.) always return a boolean
+// and coerce an undecided visitor to a region default, so they cannot express
+// "no decision". currentVisitorConsent() reports the truthful per-category state
+// as 'yes' | 'no' | '' (empty = no decision); we read that and map empty to
+// 'unknown'.
+const hasConsentDecision = () => {
+    var _a, _b, _c;
+    const consent = (_c = (_b = (_a = window.Shopify) === null || _a === void 0 ? void 0 : _a.customerPrivacy) === null || _b === void 0 ? void 0 : _b.currentVisitorConsent) === null || _c === void 0 ? void 0 : _c.call(_b);
+    return (!!consent && Object.values(consent).some((v) => v === 'yes' || v === 'no'));
+};
+const waitForCustomerPrivacy = () => {
+    return new Promise((resolve) => {
+        if (hasConsentDecision()) {
+            resolve(true);
+            return;
+        }
+        let attempts = 0;
+        const interval = setInterval(() => {
+            attempts++;
+            if (hasConsentDecision()) {
+                clearInterval(interval);
+                resolve(true);
+            }
+            else if (attempts >= 20) {
+                clearInterval(interval);
+                resolve(false);
+            }
+        }, 250);
+    });
+};
+const mapVisitorConsent = (value) => {
+    if (value === 'yes') {
+        return '1';
+    }
+    if (value === 'no') {
+        return '0';
+    }
+    return 'unknown';
+};
+const getConsentData = () => {
+    var _a, _b, _c;
+    const cp = (_a = window.Shopify) === null || _a === void 0 ? void 0 : _a.customerPrivacy;
+    const consent = (_b = cp === null || cp === void 0 ? void 0 : cp.currentVisitorConsent) === null || _b === void 0 ? void 0 : _b.call(cp);
+    return {
+        analyticsAllowed: mapVisitorConsent(consent === null || consent === void 0 ? void 0 : consent['analytics']),
+        marketingAllowed: mapVisitorConsent(consent === null || consent === void 0 ? void 0 : consent['marketing']),
+        saleOfDataAllowed: mapVisitorConsent(consent === null || consent === void 0 ? void 0 : consent['sale_of_data']),
+        preferencesAllowed: mapVisitorConsent(consent === null || consent === void 0 ? void 0 : consent['preferences']),
+        saleOfDataRegion: processConsent((_c = cp === null || cp === void 0 ? void 0 : cp.saleOfDataRegion) === null || _c === void 0 ? void 0 : _c.call(cp)),
+    };
+};
+/**
+ * Collects consent from Shopify's Customer Privacy API and forwards it to the
+ * Blotout backend. On a new session it waits for the privacy API to become ready
+ * (via {@link waitForCustomerPrivacy}) and sends the current state; it then
+ * registers a `visitorConsentCollected` listener so later changes are forwarded
+ * in real time.
+ *
+ * @param ctx - {@link CollectAnalyticsContext} with the backend `baseUrl` and
+ *   whether this is a new session.
+ */
+const collectShopifyConsentAnalytics = ({ baseUrl, isNewSession, }) => {
+    if (isNewSession) {
+        waitForCustomerPrivacy().then(() => {
+            sendConsentData(baseUrl, getConsentData());
+        });
+    }
+    const onVisitorConsentCollected = (event) => {
+        var _a, _b, _c;
+        const ev = event;
+        const detail = ((_a = ev.detail) !== null && _a !== void 0 ? _a : {});
+        const cp = (_b = window.Shopify) === null || _b === void 0 ? void 0 : _b.customerPrivacy;
+        sendConsentData(baseUrl, {
+            analyticsAllowed: processConsent(detail === null || detail === void 0 ? void 0 : detail.analyticsAllowed),
+            marketingAllowed: processConsent(detail === null || detail === void 0 ? void 0 : detail.marketingAllowed),
+            saleOfDataAllowed: processConsent(detail === null || detail === void 0 ? void 0 : detail.saleOfDataAllowed),
+            preferencesAllowed: processConsent(detail === null || detail === void 0 ? void 0 : detail.preferencesAllowed),
+            saleOfDataRegion: processConsent((_c = cp === null || cp === void 0 ? void 0 : cp.saleOfDataRegion) === null || _c === void 0 ? void 0 : _c.call(cp)),
+        });
+    };
+    document.addEventListener('visitorConsentCollected', onVisitorConsentCollected);
+};
+
+var _a, _b;
+var _c;
+/**
+ * Shopify consentIQ store adapter. Loaded as a separate bundle by the CDN
+ * `/load` handler only when the platform is Shopify, and self-registers its
+ * factory on the shared registry so the core `init` can pick it up.
+ */
+const createShopifyStoreAPI = () => ({
+    platform: 'shopify',
+    collectAnalytics: collectShopifyConsentAnalytics,
+});
+if (typeof window !== 'undefined') {
+    (_a = window[registryKey]) !== null && _a !== void 0 ? _a : (window[registryKey] = {});
+    (_b = (_c = window[registryKey]).storeAPIFactory) !== null && _b !== void 0 ? _b : (_c.storeAPIFactory = createShopifyStoreAPI);
+}

package/stores/shopify/index.js

@@ -0,0 +1,265 @@
+(function () {
+    'use strict';
+
+    /**
+     * Global registry key shared across the separately-loaded consentIQ bundles
+     * (core `index` and the per-store adapter). `Symbol.for` resolves to the same
+     * symbol in every bundle, so the store adapter can register its factory here
+     * and the core `init` can read it back.
+     */
+    const registryKey = Symbol.for('consentiq');
+
+    const canLog = () => {
+        try {
+            return localStorage.getItem('edgeTagDebug') === '1';
+        }
+        catch {
+            return false;
+        }
+    };
+    const prefix = `[EdgeTag]`;
+    const logger = {
+        log: (...args) => {
+            if (canLog()) {
+                console.log(prefix, ...args);
+            }
+        },
+        error: (...args) => {
+            if (canLog()) {
+                console.error(prefix, ...args);
+            }
+        },
+        info: (...args) => {
+            if (canLog()) {
+                console.info(prefix, ...args);
+            }
+        },
+        trace: (...args) => {
+            if (canLog()) {
+                console.trace(prefix, ...args);
+            }
+        },
+    };
+
+    const getOnetrustConsent = () => {
+        try {
+            const name = 'OptanonConsent';
+            const cookie = document.cookie.match(new RegExp('(^| )' + name + '=([^;]+)'));
+            if (cookie && cookie.length > 2) {
+                const match = decodeURIComponent(cookie[2]).match(new RegExp('&groups=([^&]+)'));
+                if (match && match.length > 1) {
+                    const data = match[1].split(',');
+                    if (!data) {
+                        return null;
+                    }
+                    return {
+                        analyticsSetting: data.some((g) => g === 'C0002:1' || g === '2:1')
+                            ? 'allowed'
+                            : 'disallowed',
+                        marketingSetting: data.some((g) => g === 'C0004:1' || g === '4:1' || g === 'C0005:1' || g === '5:1')
+                            ? 'allowed'
+                            : 'disallowed',
+                        preferencesSetting: data.some((g) => g === 'C0003:1' || g === '3:1')
+                            ? 'allowed'
+                            : 'disallowed',
+                    };
+                }
+            }
+            return null;
+        }
+        catch {
+            return null;
+        }
+    };
+    const getOsanoConsent = () => {
+        try {
+            const osano = window.Osano;
+            if (!(osano === null || osano === void 0 ? void 0 : osano.cm)) {
+                return null;
+            }
+            return {
+                analyticsSetting: osano.cm.analytics ? 'allowed' : 'disallowed',
+                marketingSetting: osano.cm.marketing ? 'allowed' : 'disallowed',
+                preferencesSetting: osano.cm.personalization ? 'allowed' : 'disallowed',
+                saleOfDataSetting: osano.cm.optOut ? 'disallowed' : 'allowed',
+            };
+        }
+        catch {
+            return null;
+        }
+    };
+    const getTermlyConsent = () => {
+        var _a, _b;
+        try {
+            const state = (_b = (_a = window.Termly) === null || _a === void 0 ? void 0 : _a.getConsentState) === null || _b === void 0 ? void 0 : _b.call(_a);
+            if (!state) {
+                return null;
+            }
+            return {
+                analyticsSetting: state.analytics ? 'allowed' : 'disallowed',
+                marketingSetting: state.advertising || state.social_networking ? 'allowed' : 'disallowed',
+                preferencesSetting: state.performance ? 'allowed' : 'disallowed',
+            };
+        }
+        catch {
+            return null;
+        }
+    };
+    /**
+     * Reads the current decision from a supported external CMP (OneTrust, Osano, or
+     * Termly), if one is present. Applies regardless of host platform and takes
+     * precedence over the platform-derived `*Setting` fields in {@link sendConsentData}.
+     */
+    const getConsentSettings = () => {
+        const oneTrustConsent = getOnetrustConsent();
+        if (oneTrustConsent) {
+            return oneTrustConsent;
+        }
+        const osanoConsent = getOsanoConsent();
+        if (osanoConsent) {
+            return osanoConsent;
+        }
+        const termlyConsent = getTermlyConsent();
+        if (termlyConsent) {
+            return termlyConsent;
+        }
+        return {};
+    };
+    /**
+     * POSTs a consent snapshot to the Blotout backend `consentIQ/save-data`
+     * endpoint. The platform collector builds `body`; an external CMP still wins via
+     * {@link getConsentSettings}. Errors are logged and swallowed so consent capture
+     * never breaks the host page.
+     */
+    const sendConsentData = async (baseUrl, body) => {
+        const finalBody = {
+            ...body,
+            analyticsSetting: 'unknown',
+            marketingSetting: 'unknown',
+            preferencesSetting: 'unknown',
+            saleOfDataSetting: 'unknown',
+            // An external CMP (OneTrust/Osano/Termly) wins over the 'unknown' defaults.
+            ...getConsentSettings(),
+        };
+        try {
+            const response = await fetch(`${baseUrl}/providers/consentIQ/save-data`, {
+                method: 'POST',
+                body: JSON.stringify(finalBody),
+                headers: { 'Content-Type': 'application/json' },
+                credentials: 'include',
+            });
+            if (!response.ok) {
+                throw new Error(`save-data returned ${response.status} ${response.statusText}`);
+            }
+        }
+        catch (e) {
+            logger.error('[consentIQ] Failed to send consent data', e);
+        }
+    };
+
+    const processConsent = (consent) => {
+        if (consent == null) {
+            return 'unknown';
+        }
+        return consent ? '1' : '0';
+    };
+    // Shopify's boolean helpers (marketingAllowed(), etc.) always return a boolean
+    // and coerce an undecided visitor to a region default, so they cannot express
+    // "no decision". currentVisitorConsent() reports the truthful per-category state
+    // as 'yes' | 'no' | '' (empty = no decision); we read that and map empty to
+    // 'unknown'.
+    const hasConsentDecision = () => {
+        var _a, _b, _c;
+        const consent = (_c = (_b = (_a = window.Shopify) === null || _a === void 0 ? void 0 : _a.customerPrivacy) === null || _b === void 0 ? void 0 : _b.currentVisitorConsent) === null || _c === void 0 ? void 0 : _c.call(_b);
+        return (!!consent && Object.values(consent).some((v) => v === 'yes' || v === 'no'));
+    };
+    const waitForCustomerPrivacy = () => {
+        return new Promise((resolve) => {
+            if (hasConsentDecision()) {
+                resolve(true);
+                return;
+            }
+            let attempts = 0;
+            const interval = setInterval(() => {
+                attempts++;
+                if (hasConsentDecision()) {
+                    clearInterval(interval);
+                    resolve(true);
+                }
+                else if (attempts >= 20) {
+                    clearInterval(interval);
+                    resolve(false);
+                }
+            }, 250);
+        });
+    };
+    const mapVisitorConsent = (value) => {
+        if (value === 'yes') {
+            return '1';
+        }
+        if (value === 'no') {
+            return '0';
+        }
+        return 'unknown';
+    };
+    const getConsentData = () => {
+        var _a, _b, _c;
+        const cp = (_a = window.Shopify) === null || _a === void 0 ? void 0 : _a.customerPrivacy;
+        const consent = (_b = cp === null || cp === void 0 ? void 0 : cp.currentVisitorConsent) === null || _b === void 0 ? void 0 : _b.call(cp);
+        return {
+            analyticsAllowed: mapVisitorConsent(consent === null || consent === void 0 ? void 0 : consent['analytics']),
+            marketingAllowed: mapVisitorConsent(consent === null || consent === void 0 ? void 0 : consent['marketing']),
+            saleOfDataAllowed: mapVisitorConsent(consent === null || consent === void 0 ? void 0 : consent['sale_of_data']),
+            preferencesAllowed: mapVisitorConsent(consent === null || consent === void 0 ? void 0 : consent['preferences']),
+            saleOfDataRegion: processConsent((_c = cp === null || cp === void 0 ? void 0 : cp.saleOfDataRegion) === null || _c === void 0 ? void 0 : _c.call(cp)),
+        };
+    };
+    /**
+     * Collects consent from Shopify's Customer Privacy API and forwards it to the
+     * Blotout backend. On a new session it waits for the privacy API to become ready
+     * (via {@link waitForCustomerPrivacy}) and sends the current state; it then
+     * registers a `visitorConsentCollected` listener so later changes are forwarded
+     * in real time.
+     *
+     * @param ctx - {@link CollectAnalyticsContext} with the backend `baseUrl` and
+     *   whether this is a new session.
+     */
+    const collectShopifyConsentAnalytics = ({ baseUrl, isNewSession, }) => {
+        if (isNewSession) {
+            waitForCustomerPrivacy().then(() => {
+                sendConsentData(baseUrl, getConsentData());
+            });
+        }
+        const onVisitorConsentCollected = (event) => {
+            var _a, _b, _c;
+            const ev = event;
+            const detail = ((_a = ev.detail) !== null && _a !== void 0 ? _a : {});
+            const cp = (_b = window.Shopify) === null || _b === void 0 ? void 0 : _b.customerPrivacy;
+            sendConsentData(baseUrl, {
+                analyticsAllowed: processConsent(detail === null || detail === void 0 ? void 0 : detail.analyticsAllowed),
+                marketingAllowed: processConsent(detail === null || detail === void 0 ? void 0 : detail.marketingAllowed),
+                saleOfDataAllowed: processConsent(detail === null || detail === void 0 ? void 0 : detail.saleOfDataAllowed),
+                preferencesAllowed: processConsent(detail === null || detail === void 0 ? void 0 : detail.preferencesAllowed),
+                saleOfDataRegion: processConsent((_c = cp === null || cp === void 0 ? void 0 : cp.saleOfDataRegion) === null || _c === void 0 ? void 0 : _c.call(cp)),
+            });
+        };
+        document.addEventListener('visitorConsentCollected', onVisitorConsentCollected);
+    };
+
+    var _a, _b;
+    var _c;
+    /**
+     * Shopify consentIQ store adapter. Loaded as a separate bundle by the CDN
+     * `/load` handler only when the platform is Shopify, and self-registers its
+     * factory on the shared registry so the core `init` can pick it up.
+     */
+    const createShopifyStoreAPI = () => ({
+        platform: 'shopify',
+        collectAnalytics: collectShopifyConsentAnalytics,
+    });
+    if (typeof window !== 'undefined') {
+        (_a = window[registryKey]) !== null && _a !== void 0 ? _a : (window[registryKey] = {});
+        (_b = (_c = window[registryKey]).storeAPIFactory) !== null && _b !== void 0 ? _b : (_c.storeAPIFactory = createShopifyStoreAPI);
+    }
+
+})();

package/stores/shopify/index.mjs

@@ -0,0 +1,260 @@
+/**
+ * Global registry key shared across the separately-loaded consentIQ bundles
+ * (core `index` and the per-store adapter). `Symbol.for` resolves to the same
+ * symbol in every bundle, so the store adapter can register its factory here
+ * and the core `init` can read it back.
+ */
+const registryKey = Symbol.for('consentiq');
+
+const canLog = () => {
+    try {
+        return localStorage.getItem('edgeTagDebug') === '1';
+    }
+    catch {
+        return false;
+    }
+};
+const prefix = `[EdgeTag]`;
+const logger = {
+    log: (...args) => {
+        if (canLog()) {
+            console.log(prefix, ...args);
+        }
+    },
+    error: (...args) => {
+        if (canLog()) {
+            console.error(prefix, ...args);
+        }
+    },
+    info: (...args) => {
+        if (canLog()) {
+            console.info(prefix, ...args);
+        }
+    },
+    trace: (...args) => {
+        if (canLog()) {
+            console.trace(prefix, ...args);
+        }
+    },
+};
+
+const getOnetrustConsent = () => {
+    try {
+        const name = 'OptanonConsent';
+        const cookie = document.cookie.match(new RegExp('(^| )' + name + '=([^;]+)'));
+        if (cookie && cookie.length > 2) {
+            const match = decodeURIComponent(cookie[2]).match(new RegExp('&groups=([^&]+)'));
+            if (match && match.length > 1) {
+                const data = match[1].split(',');
+                if (!data) {
+                    return null;
+                }
+                return {
+                    analyticsSetting: data.some((g) => g === 'C0002:1' || g === '2:1')
+                        ? 'allowed'
+                        : 'disallowed',
+                    marketingSetting: data.some((g) => g === 'C0004:1' || g === '4:1' || g === 'C0005:1' || g === '5:1')
+                        ? 'allowed'
+                        : 'disallowed',
+                    preferencesSetting: data.some((g) => g === 'C0003:1' || g === '3:1')
+                        ? 'allowed'
+                        : 'disallowed',
+                };
+            }
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+};
+const getOsanoConsent = () => {
+    try {
+        const osano = window.Osano;
+        if (!(osano === null || osano === void 0 ? void 0 : osano.cm)) {
+            return null;
+        }
+        return {
+            analyticsSetting: osano.cm.analytics ? 'allowed' : 'disallowed',
+            marketingSetting: osano.cm.marketing ? 'allowed' : 'disallowed',
+            preferencesSetting: osano.cm.personalization ? 'allowed' : 'disallowed',
+            saleOfDataSetting: osano.cm.optOut ? 'disallowed' : 'allowed',
+        };
+    }
+    catch {
+        return null;
+    }
+};
+const getTermlyConsent = () => {
+    var _a, _b;
+    try {
+        const state = (_b = (_a = window.Termly) === null || _a === void 0 ? void 0 : _a.getConsentState) === null || _b === void 0 ? void 0 : _b.call(_a);
+        if (!state) {
+            return null;
+        }
+        return {
+            analyticsSetting: state.analytics ? 'allowed' : 'disallowed',
+            marketingSetting: state.advertising || state.social_networking ? 'allowed' : 'disallowed',
+            preferencesSetting: state.performance ? 'allowed' : 'disallowed',
+        };
+    }
+    catch {
+        return null;
+    }
+};
+/**
+ * Reads the current decision from a supported external CMP (OneTrust, Osano, or
+ * Termly), if one is present. Applies regardless of host platform and takes
+ * precedence over the platform-derived `*Setting` fields in {@link sendConsentData}.
+ */
+const getConsentSettings = () => {
+    const oneTrustConsent = getOnetrustConsent();
+    if (oneTrustConsent) {
+        return oneTrustConsent;
+    }
+    const osanoConsent = getOsanoConsent();
+    if (osanoConsent) {
+        return osanoConsent;
+    }
+    const termlyConsent = getTermlyConsent();
+    if (termlyConsent) {
+        return termlyConsent;
+    }
+    return {};
+};
+/**
+ * POSTs a consent snapshot to the Blotout backend `consentIQ/save-data`
+ * endpoint. The platform collector builds `body`; an external CMP still wins via
+ * {@link getConsentSettings}. Errors are logged and swallowed so consent capture
+ * never breaks the host page.
+ */
+const sendConsentData = async (baseUrl, body) => {
+    const finalBody = {
+        ...body,
+        analyticsSetting: 'unknown',
+        marketingSetting: 'unknown',
+        preferencesSetting: 'unknown',
+        saleOfDataSetting: 'unknown',
+        // An external CMP (OneTrust/Osano/Termly) wins over the 'unknown' defaults.
+        ...getConsentSettings(),
+    };
+    try {
+        const response = await fetch(`${baseUrl}/providers/consentIQ/save-data`, {
+            method: 'POST',
+            body: JSON.stringify(finalBody),
+            headers: { 'Content-Type': 'application/json' },
+            credentials: 'include',
+        });
+        if (!response.ok) {
+            throw new Error(`save-data returned ${response.status} ${response.statusText}`);
+        }
+    }
+    catch (e) {
+        logger.error('[consentIQ] Failed to send consent data', e);
+    }
+};
+
+const processConsent = (consent) => {
+    if (consent == null) {
+        return 'unknown';
+    }
+    return consent ? '1' : '0';
+};
+// Shopify's boolean helpers (marketingAllowed(), etc.) always return a boolean
+// and coerce an undecided visitor to a region default, so they cannot express
+// "no decision". currentVisitorConsent() reports the truthful per-category state
+// as 'yes' | 'no' | '' (empty = no decision); we read that and map empty to
+// 'unknown'.
+const hasConsentDecision = () => {
+    var _a, _b, _c;
+    const consent = (_c = (_b = (_a = window.Shopify) === null || _a === void 0 ? void 0 : _a.customerPrivacy) === null || _b === void 0 ? void 0 : _b.currentVisitorConsent) === null || _c === void 0 ? void 0 : _c.call(_b);
+    return (!!consent && Object.values(consent).some((v) => v === 'yes' || v === 'no'));
+};
+const waitForCustomerPrivacy = () => {
+    return new Promise((resolve) => {
+        if (hasConsentDecision()) {
+            resolve(true);
+            return;
+        }
+        let attempts = 0;
+        const interval = setInterval(() => {
+            attempts++;
+            if (hasConsentDecision()) {
+                clearInterval(interval);
+                resolve(true);
+            }
+            else if (attempts >= 20) {
+                clearInterval(interval);
+                resolve(false);
+            }
+        }, 250);
+    });
+};
+const mapVisitorConsent = (value) => {
+    if (value === 'yes') {
+        return '1';
+    }
+    if (value === 'no') {
+        return '0';
+    }
+    return 'unknown';
+};
+const getConsentData = () => {
+    var _a, _b, _c;
+    const cp = (_a = window.Shopify) === null || _a === void 0 ? void 0 : _a.customerPrivacy;
+    const consent = (_b = cp === null || cp === void 0 ? void 0 : cp.currentVisitorConsent) === null || _b === void 0 ? void 0 : _b.call(cp);
+    return {
+        analyticsAllowed: mapVisitorConsent(consent === null || consent === void 0 ? void 0 : consent['analytics']),
+        marketingAllowed: mapVisitorConsent(consent === null || consent === void 0 ? void 0 : consent['marketing']),
+        saleOfDataAllowed: mapVisitorConsent(consent === null || consent === void 0 ? void 0 : consent['sale_of_data']),
+        preferencesAllowed: mapVisitorConsent(consent === null || consent === void 0 ? void 0 : consent['preferences']),
+        saleOfDataRegion: processConsent((_c = cp === null || cp === void 0 ? void 0 : cp.saleOfDataRegion) === null || _c === void 0 ? void 0 : _c.call(cp)),
+    };
+};
+/**
+ * Collects consent from Shopify's Customer Privacy API and forwards it to the
+ * Blotout backend. On a new session it waits for the privacy API to become ready
+ * (via {@link waitForCustomerPrivacy}) and sends the current state; it then
+ * registers a `visitorConsentCollected` listener so later changes are forwarded
+ * in real time.
+ *
+ * @param ctx - {@link CollectAnalyticsContext} with the backend `baseUrl` and
+ *   whether this is a new session.
+ */
+const collectShopifyConsentAnalytics = ({ baseUrl, isNewSession, }) => {
+    if (isNewSession) {
+        waitForCustomerPrivacy().then(() => {
+            sendConsentData(baseUrl, getConsentData());
+        });
+    }
+    const onVisitorConsentCollected = (event) => {
+        var _a, _b, _c;
+        const ev = event;
+        const detail = ((_a = ev.detail) !== null && _a !== void 0 ? _a : {});
+        const cp = (_b = window.Shopify) === null || _b === void 0 ? void 0 : _b.customerPrivacy;
+        sendConsentData(baseUrl, {
+            analyticsAllowed: processConsent(detail === null || detail === void 0 ? void 0 : detail.analyticsAllowed),
+            marketingAllowed: processConsent(detail === null || detail === void 0 ? void 0 : detail.marketingAllowed),
+            saleOfDataAllowed: processConsent(detail === null || detail === void 0 ? void 0 : detail.saleOfDataAllowed),
+            preferencesAllowed: processConsent(detail === null || detail === void 0 ? void 0 : detail.preferencesAllowed),
+            saleOfDataRegion: processConsent((_c = cp === null || cp === void 0 ? void 0 : cp.saleOfDataRegion) === null || _c === void 0 ? void 0 : _c.call(cp)),
+        });
+    };
+    document.addEventListener('visitorConsentCollected', onVisitorConsentCollected);
+};
+
+var _a, _b;
+var _c;
+/**
+ * Shopify consentIQ store adapter. Loaded as a separate bundle by the CDN
+ * `/load` handler only when the platform is Shopify, and self-registers its
+ * factory on the shared registry so the core `init` can pick it up.
+ */
+const createShopifyStoreAPI = () => ({
+    platform: 'shopify',
+    collectAnalytics: collectShopifyConsentAnalytics,
+});
+if (typeof window !== 'undefined') {
+    (_a = window[registryKey]) !== null && _a !== void 0 ? _a : (window[registryKey] = {});
+    (_b = (_c = window[registryKey]).storeAPIFactory) !== null && _b !== void 0 ? _b : (_c.storeAPIFactory = createShopifyStoreAPI);
+}