@buildinams/core 0.3.0 → 0.4.0

package/dist/consent/google/index.js

@@ -0,0 +1,48 @@
+// src/consent/google/google.ts
+var GRANTED = "granted";
+var DENIED = "denied";
+var toConsentModeState = (consent) => {
+  const state = (allowed) => allowed ? GRANTED : DENIED;
+  return {
+    functionality_storage: state(consent.preferences),
+    personalization_storage: state(consent.preferences),
+    analytics_storage: state(consent.analytics),
+    ad_storage: state(consent.marketing),
+    ad_user_data: state(consent.marketing),
+    ad_personalization: state(consent.marketing),
+    security_storage: GRANTED
+  };
+};
+var googleConsentMode = ({
+  dataLayerName = "dataLayer",
+  waitForUpdate = 500
+} = {}) => {
+  const dataLayer = () => {
+    const target = window;
+    return target[dataLayerName] ??= [];
+  };
+  function gtag(..._args) {
+    dataLayer().push(arguments);
+  }
+  const isDefaultCommand = (entry) => Object.prototype.toString.call(entry) === "[object Arguments]" && entry[0] === "consent" && entry[1] === "default";
+  if (typeof window !== "undefined" && !dataLayer().some(isDefaultCommand)) {
+    gtag("consent", "default", {
+      ...toConsentModeState({
+        preferences: false,
+        analytics: false,
+        marketing: false
+      }),
+      wait_for_update: waitForUpdate
+    });
+  }
+  return {
+    name: "google-consent-mode",
+    apply: (consent) => {
+      gtag("consent", "update", toConsentModeState(consent));
+    }
+  };
+};
+
+export { googleConsentMode };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/consent/google/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/consent/google/google.ts"],"names":[],"mappings":";AAEA,IAAM,OAAA,GAAU,SAAA;AAChB,IAAM,MAAA,GAAS,QAAA;AAGR,IAAM,kBAAA,GAAqB,CAAC,OAAA,KAAqB;AACvD,EAAA,MAAM,KAAA,GAAQ,CAAC,OAAA,KAAsB,OAAA,GAAU,OAAA,GAAU,MAAA;AACzD,EAAA,OAAO;AAAA,IACN,qBAAA,EAAuB,KAAA,CAAM,OAAA,CAAQ,WAAW,CAAA;AAAA,IAChD,uBAAA,EAAyB,KAAA,CAAM,OAAA,CAAQ,WAAW,CAAA;AAAA,IAClD,iBAAA,EAAmB,KAAA,CAAM,OAAA,CAAQ,SAAS,CAAA;AAAA,IAC1C,UAAA,EAAY,KAAA,CAAM,OAAA,CAAQ,SAAS,CAAA;AAAA,IACnC,YAAA,EAAc,KAAA,CAAM,OAAA,CAAQ,SAAS,CAAA;AAAA,IACrC,kBAAA,EAAoB,KAAA,CAAM,OAAA,CAAQ,SAAS,CAAA;AAAA,IAC3C,gBAAA,EAAkB;AAAA,GACnB;AACD,CAAA;AAqBO,IAAM,oBAAoB,CAAC;AAAA,EACjC,aAAA,GAAgB,WAAA;AAAA,EAChB,aAAA,GAAgB;AACjB,CAAA,GAA8B,EAAC,KAAqB;AACnD,EAAA,MAAM,YAAY,MAAM;AACvB,IAAA,MAAM,MAAA,GAAS,MAAA;AACf,IAAA,OAAQ,MAAA,CAAO,aAAa,CAAA,KAAM,EAAC;AAAA,EACpC,CAAA;AAEA,EAAA,SAAS,QAAQ,KAAA,EAAkB;AAElC,IAAA,SAAA,EAAU,CAAE,KAAK,SAAS,CAAA;AAAA,EAC3B;AACA,EAAA,MAAM,mBAAmB,CAAC,KAAA,KACzB,MAAA,CAAO,SAAA,CAAU,SAAS,IAAA,CAAK,KAAK,CAAA,KAAM,oBAAA,IACzC,MAA6B,CAAC,CAAA,KAAM,SAAA,IACpC,KAAA,CAA6B,CAAC,CAAA,KAAM,SAAA;AAGtC,EAAA,IAAI,OAAO,WAAW,WAAA,IAAe,CAAC,WAAU,CAAE,IAAA,CAAK,gBAAgB,CAAA,EAAG;AACzE,IAAA,IAAA,CAAK,WAAW,SAAA,EAAW;AAAA,MAC1B,GAAG,kBAAA,CAAmB;AAAA,QACrB,WAAA,EAAa,KAAA;AAAA,QACb,SAAA,EAAW,KAAA;AAAA,QACX,SAAA,EAAW;AAAA,OACX,CAAA;AAAA,MACD,eAAA,EAAiB;AAAA,KACjB,CAAA;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACN,IAAA,EAAM,qBAAA;AAAA,IACN,KAAA,EAAO,CAAC,OAAA,KAAY;AACnB,MAAA,IAAA,CAAK,SAAA,EAAW,QAAA,EAAU,kBAAA,CAAmB,OAAO,CAAC,CAAA;AAAA,IACtD;AAAA,GACD;AACD","file":"index.js","sourcesContent":["import type { Consent, ConsentTarget } from \"../consent\";\n\nconst GRANTED = \"granted\";\nconst DENIED = \"denied\";\n\n/** Google Consent Mode v2 signals for an answer. */\nexport const toConsentModeState = (consent: Consent) => {\n\tconst state = (allowed: boolean) => (allowed ? GRANTED : DENIED);\n\treturn {\n\t\tfunctionality_storage: state(consent.preferences),\n\t\tpersonalization_storage: state(consent.preferences),\n\t\tanalytics_storage: state(consent.analytics),\n\t\tad_storage: state(consent.marketing),\n\t\tad_user_data: state(consent.marketing),\n\t\tad_personalization: state(consent.marketing),\n\t\tsecurity_storage: GRANTED,\n\t};\n};\n\nexport type GoogleConsentModeOptions = {\n\t/** Default `\"dataLayer\"`. */\n\tdataLayerName?: string;\n\t/** Milliseconds tags wait for the first answer before firing under the denied defaults. Default 500. */\n\twaitForUpdate?: number;\n};\n\n/**\n * Sends Google Consent Mode v2 signals through the dataLayer: every category denied when created, then an update for\n * every answer. Only for consent platforms without a Consent Mode integration, like Shopify's. Create it before GTM or\n * gtag.js loads, so the defaults come first.\n *\n * @see https://developers.google.com/tag-platform/security/guides/consent\n *\n * @example\n * ```ts\n * export const analytics = createAnalytics({ consent: shopifyConsent(), consentTargets: [googleConsentMode()] });\n * ```\n */\nexport const googleConsentMode = ({\n\tdataLayerName = \"dataLayer\",\n\twaitForUpdate = 500,\n}: GoogleConsentModeOptions = {}): ConsentTarget => {\n\tconst dataLayer = () => {\n\t\tconst target = window as unknown as Record<string, unknown[] | undefined>;\n\t\treturn (target[dataLayerName] ??= []);\n\t};\n\t// GTM only treats an `arguments` object as a gtag command, not an array.\n\tfunction gtag(..._args: unknown[]) {\n\t\t// eslint-disable-next-line prefer-rest-params\n\t\tdataLayer().push(arguments);\n\t}\n\tconst isDefaultCommand = (entry: unknown) =>\n\t\tObject.prototype.toString.call(entry) === \"[object Arguments]\" &&\n\t\t(entry as ArrayLike<unknown>)[0] === \"consent\" &&\n\t\t(entry as ArrayLike<unknown>)[1] === \"default\";\n\n\t// Once per dataLayer, so another instance, e.g. after a hot reload, doesn't reset earlier updates.\n\tif (typeof window !== \"undefined\" && !dataLayer().some(isDefaultCommand)) {\n\t\tgtag(\"consent\", \"default\", {\n\t\t\t...toConsentModeState({\n\t\t\t\tpreferences: false,\n\t\t\t\tanalytics: false,\n\t\t\t\tmarketing: false,\n\t\t\t}),\n\t\t\twait_for_update: waitForUpdate,\n\t\t});\n\t}\n\n\treturn {\n\t\tname: \"google-consent-mode\",\n\t\tapply: (consent) => {\n\t\t\tgtag(\"consent\", \"update\", toConsentModeState(consent));\n\t\t},\n\t};\n};\n"]}

package/dist/consent/index.d.ts

@@ -0,0 +1 @@
+export { e as CONSENT_CATEGORIES, d as Consent, a as ConsentSource, b as ConsentTarget } from '../index-Zef1nnTP.js';

package/dist/consent/index.js

@@ -0,0 +1,3 @@
+export { CONSENT_CATEGORIES } from '../chunk-MHFGMH3G.js';
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/consent/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.js"}

package/dist/consent/onetrust/index.d.ts

@@ -0,0 +1,23 @@
+import { C as ConsentCategory, a as ConsentSource } from '../../index-Zef1nnTP.js';
+
+type OneTrustConsentOptions = {
+    /**
+     * OneTrust group ids per category, all of which must be active. Defaults to OneTrust's standard groups:
+     * `C0003` (functional), `C0002` (performance) and `C0004` (targeting).
+     */
+    groups?: Partial<Record<ConsentCategory, readonly string[]>>;
+};
+/**
+ * Consent from OneTrust. Answered once the visitor closes the banner, or straight away where OneTrust shows none.
+ *
+ * @example
+ * ```ts
+ * export const analytics = createAnalytics({
+ *   consent: oneTrustConsent({ groups: { marketing: ["C0004", "C0005"] } }),
+ *   destinations: [gtmDestination()],
+ * });
+ * ```
+ */
+declare const oneTrustConsent: ({ groups: customGroups, }?: OneTrustConsentOptions) => ConsentSource;
+
+export { type OneTrustConsentOptions, oneTrustConsent };

package/dist/consent/onetrust/index.js

@@ -0,0 +1,39 @@
+import { eventConsentSource } from '../../chunk-QIJGG2F4.js';
+
+// src/consent/onetrust/onetrust.ts
+var DEFAULT_GROUPS = {
+  preferences: ["C0003"],
+  analytics: ["C0002"],
+  marketing: ["C0004"]
+};
+var oneTrustConsent = ({
+  groups: customGroups
+} = {}) => {
+  const groups = { ...DEFAULT_GROUPS, ...customGroups };
+  return eventConsentSource({
+    name: "onetrust",
+    read: () => {
+      const { OneTrust, OnetrustActiveGroups = "" } = window;
+      if (typeof OneTrust?.IsAlertBoxClosed !== "function" || typeof OneTrust.GetDomainData !== "function") {
+        return null;
+      }
+      if (!OneTrust.IsAlertBoxClosed() && OneTrust.GetDomainData().ShowAlertNotice !== false) {
+        return null;
+      }
+      const active = new Set(
+        OnetrustActiveGroups.split(",").map((id) => id.trim())
+      );
+      const granted = (category) => groups[category].every((id) => active.has(id));
+      return {
+        preferences: granted("preferences"),
+        analytics: granted("analytics"),
+        marketing: granted("marketing")
+      };
+    },
+    events: ["OneTrustGroupsUpdated"]
+  });
+};
+
+export { oneTrustConsent };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/consent/onetrust/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/consent/onetrust/onetrust.ts"],"names":[],"mappings":";;;AAsBA,IAAM,cAAA,GAA6D;AAAA,EAClE,WAAA,EAAa,CAAC,OAAO,CAAA;AAAA,EACrB,SAAA,EAAW,CAAC,OAAO,CAAA;AAAA,EACnB,SAAA,EAAW,CAAC,OAAO;AACpB,CAAA;AAaO,IAAM,kBAAkB,CAAC;AAAA,EAC/B,MAAA,EAAQ;AACT,CAAA,GAA4B,EAAC,KAAqB;AACjD,EAAA,MAAM,MAAA,GAAS,EAAE,GAAG,cAAA,EAAgB,GAAG,YAAA,EAAa;AAEpD,EAAA,OAAO,kBAAA,CAAmB;AAAA,IACzB,IAAA,EAAM,UAAA;AAAA,IACN,MAAM,MAAM;AACX,MAAA,MAAM,EAAE,QAAA,EAAU,oBAAA,GAAuB,EAAA,EAAG,GAAI,MAAA;AAEhD,MAAA,IACC,OAAO,QAAA,EAAU,gBAAA,KAAqB,cACtC,OAAO,QAAA,CAAS,kBAAkB,UAAA,EACjC;AACD,QAAA,OAAO,IAAA;AAAA,MACR;AACA,MAAA,IACC,CAAC,SAAS,gBAAA,EAAiB,IAC3B,SAAS,aAAA,EAAc,CAAE,oBAAoB,KAAA,EAC5C;AACD,QAAA,OAAO,IAAA;AAAA,MACR;AAEA,MAAA,MAAM,SAAS,IAAI,GAAA;AAAA,QAClB,oBAAA,CAAqB,MAAM,GAAG,CAAA,CAAE,IAAI,CAAC,EAAA,KAAO,EAAA,CAAG,IAAA,EAAM;AAAA,OACtD;AACA,MAAA,MAAM,OAAA,GAAU,CAAC,QAAA,KAChB,MAAA,CAAO,QAAQ,CAAA,CAAE,KAAA,CAAM,CAAC,EAAA,KAAO,MAAA,CAAO,GAAA,CAAI,EAAE,CAAC,CAAA;AAE9C,MAAA,OAAO;AAAA,QACN,WAAA,EAAa,QAAQ,aAAa,CAAA;AAAA,QAClC,SAAA,EAAW,QAAQ,WAAW,CAAA;AAAA,QAC9B,SAAA,EAAW,QAAQ,WAAW;AAAA,OAC/B;AAAA,IACD,CAAA;AAAA,IACA,MAAA,EAAQ,CAAC,uBAAuB;AAAA,GAChC,CAAA;AACF","file":"index.js","sourcesContent":["import type { ConsentCategory, ConsentSource } from \"../consent\";\nimport { eventConsentSource } from \"../event-consent-source\";\n\ntype OneTrustGlobal = {\n\tIsAlertBoxClosed?: () => boolean;\n\tGetDomainData?: () => { ShowAlertNotice?: boolean };\n};\n\ntype OneTrustWindow = {\n\tOneTrust?: OneTrustGlobal;\n\t/** Comma-separated active group ids, e.g. `\",C0001,C0002,\"`. */\n\tOnetrustActiveGroups?: string;\n};\n\nexport type OneTrustConsentOptions = {\n\t/**\n\t * OneTrust group ids per category, all of which must be active. Defaults to OneTrust's standard groups:\n\t * `C0003` (functional), `C0002` (performance) and `C0004` (targeting).\n\t */\n\tgroups?: Partial<Record<ConsentCategory, readonly string[]>>;\n};\n\nconst DEFAULT_GROUPS: Record<ConsentCategory, readonly string[]> = {\n\tpreferences: [\"C0003\"],\n\tanalytics: [\"C0002\"],\n\tmarketing: [\"C0004\"],\n};\n\n/**\n * Consent from OneTrust. Answered once the visitor closes the banner, or straight away where OneTrust shows none.\n *\n * @example\n * ```ts\n * export const analytics = createAnalytics({\n *   consent: oneTrustConsent({ groups: { marketing: [\"C0004\", \"C0005\"] } }),\n *   destinations: [gtmDestination()],\n * });\n * ```\n */\nexport const oneTrustConsent = ({\n\tgroups: customGroups,\n}: OneTrustConsentOptions = {}): ConsentSource => {\n\tconst groups = { ...DEFAULT_GROUPS, ...customGroups };\n\n\treturn eventConsentSource({\n\t\tname: \"onetrust\",\n\t\tread: () => {\n\t\t\tconst { OneTrust, OnetrustActiveGroups = \"\" } = window as OneTrustWindow;\n\t\t\t// `window.OneTrust` can exist as a partial object before the SDK has loaded.\n\t\t\tif (\n\t\t\t\ttypeof OneTrust?.IsAlertBoxClosed !== \"function\" ||\n\t\t\t\ttypeof OneTrust.GetDomainData !== \"function\"\n\t\t\t) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\tif (\n\t\t\t\t!OneTrust.IsAlertBoxClosed() &&\n\t\t\t\tOneTrust.GetDomainData().ShowAlertNotice !== false\n\t\t\t) {\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\tconst active = new Set(\n\t\t\t\tOnetrustActiveGroups.split(\",\").map((id) => id.trim()),\n\t\t\t);\n\t\t\tconst granted = (category: ConsentCategory) =>\n\t\t\t\tgroups[category].every((id) => active.has(id));\n\n\t\t\treturn {\n\t\t\t\tpreferences: granted(\"preferences\"),\n\t\t\t\tanalytics: granted(\"analytics\"),\n\t\t\t\tmarketing: granted(\"marketing\"),\n\t\t\t};\n\t\t},\n\t\tevents: [\"OneTrustGroupsUpdated\"],\n\t});\n};\n"]}

package/dist/consent/shopify/index.d.ts

@@ -0,0 +1,44 @@
+import { a as ConsentSource, b as ConsentTarget, d as Consent } from '../../index-Zef1nnTP.js';
+
+/**
+ * Consent from Shopify's Customer Privacy API, e.g. collected by Shopify's privacy banner through
+ * `<ShopifyScripts consent={{ mode: "default-banner" }} />`. Answered once the visitor responds, or straight away where
+ * Shopify shows no banner. `marketing` needs both `marketing` and `sale_of_data`, so an opt-out of data sale also stops
+ * third-party ad tags, as Shopify does for pixels that count as a sale.
+ *
+ * @see https://shopify.dev/docs/api/customer-privacy
+ *
+ * @example
+ * ```ts
+ * export const analytics = createAnalytics({ consent: shopifyConsent(), destinations: [shopifyDestination()] });
+ * ```
+ */
+declare const shopifyConsent: () => ConsentSource;
+type ShopifyCustomerPrivacyOptions = {
+    /**
+     * What to set `sale_of_data` to, which no category covers. Default `false`. Pass `(consent) => consent.marketing` to
+     * have it follow marketing.
+     */
+    saleOfData?: boolean | ((consent: Consent) => boolean);
+};
+type ShopifyCustomerPrivacy = ConsentTarget & {
+    /**
+     * Pass to `<ShopifyScripts consent={{ mode: "custom-banner", setup }} />`. Resolves once the visitor's answer has
+     * reached the Customer Privacy API, which releases Hydrogen's analytics bus.
+     */
+    syncConsent: () => Promise<void>;
+};
+/**
+ * Tells Shopify's Customer Privacy API the visitor's consent, so Shopify's scripts and checkout follow it: `preferences`,
+ * `analytics` and `marketing` as they are, `sale_of_data` from `saleOfData`. Skipped when `shopifyConsent()` is the
+ * source.
+ *
+ * @example
+ * ```ts
+ * export const customerPrivacy = shopifyCustomerPrivacy();
+ * export const analytics = createAnalytics({ consent: cookiebotConsent(), consentTargets: [customerPrivacy] });
+ * ```
+ */
+declare const shopifyCustomerPrivacy: ({ saleOfData, }?: ShopifyCustomerPrivacyOptions) => ShopifyCustomerPrivacy;
+
+export { type ShopifyCustomerPrivacy, type ShopifyCustomerPrivacyOptions, shopifyConsent, shopifyCustomerPrivacy };

package/dist/consent/shopify/index.js

@@ -0,0 +1,84 @@
+import { eventConsentSource } from '../../chunk-QIJGG2F4.js';
+import { IS_DEVELOPMENT } from '../../chunk-GQVN2ECX.js';
+
+// src/consent/shopify/shopify.ts
+var NAME = "shopify";
+var SYNC_WARNING_DELAY = 1e4;
+var getCustomerPrivacy = () => window.Shopify?.customerPrivacy;
+var hasAnswered = (privacy) => {
+  if (privacy.shouldShowBanner?.() === false) return true;
+  const { analytics, marketing, preferences } = privacy.currentVisitorConsent?.() ?? {};
+  return [analytics, marketing, preferences].some((value) => !!value);
+};
+var shopifyConsent = () => eventConsentSource({
+  name: NAME,
+  read: () => {
+    const privacy = getCustomerPrivacy();
+    if (typeof privacy?.analyticsProcessingAllowed !== "function" || privacy.consentStatus !== void 0 && privacy.consentStatus !== "loaded") {
+      return null;
+    }
+    const api = privacy;
+    if (!hasAnswered(api)) return null;
+    return {
+      preferences: api.preferencesProcessingAllowed(),
+      analytics: api.analyticsProcessingAllowed(),
+      marketing: api.marketingAllowed() && api.saleOfDataAllowed()
+    };
+  },
+  events: ["consentTrackingApiLoaded", "visitorConsentCollected"],
+  target: () => document
+});
+var shopifyCustomerPrivacy = ({
+  saleOfData = false
+} = {}) => {
+  let latest;
+  let resolveAnswered;
+  const answered = new Promise((resolve) => {
+    resolveAnswered = resolve;
+  });
+  const setTrackingConsent = (consent, required = false) => new Promise((resolve, reject) => {
+    const privacy = getCustomerPrivacy();
+    if (!privacy?.setTrackingConsent) {
+      if (required) {
+        reject(new Error("Shopify's Customer Privacy API hasn't loaded."));
+      } else {
+        resolve();
+      }
+      return;
+    }
+    privacy.setTrackingConsent(
+      {
+        analytics: consent.analytics,
+        marketing: consent.marketing,
+        preferences: consent.preferences,
+        sale_of_data: typeof saleOfData === "function" ? saleOfData(consent) : saleOfData
+      },
+      (result) => {
+        if (result?.error) reject(new Error(result.error));
+        else resolve();
+      }
+    );
+  });
+  return {
+    name: NAME,
+    apply: (consent) => {
+      latest = consent;
+      resolveAnswered();
+      return setTrackingConsent(consent);
+    },
+    syncConsent: async () => {
+      const warning = IS_DEVELOPMENT && latest === void 0 ? setTimeout(() => {
+        console.warn(
+          '[consent] shopifyCustomerPrivacy().syncConsent is still waiting for an answer. It never gets one when shopifyConsent() is the source: use <ShopifyScripts consent={{ mode: "default-banner" }} /> then.'
+        );
+      }, SYNC_WARNING_DELAY) : void 0;
+      await answered;
+      clearTimeout(warning);
+      await setTrackingConsent(latest, true);
+    }
+  };
+};
+
+export { shopifyConsent, shopifyCustomerPrivacy };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/consent/shopify/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/consent/shopify/shopify.ts"],"names":[],"mappings":";;;;AAIA,IAAM,IAAA,GAAO,SAAA;AAGb,IAAM,kBAAA,GAAqB,GAAA;AA2B3B,IAAM,kBAAA,GAAqB,MACzB,MAAA,CACC,OAAA,EAAS,eAAA;AAEZ,IAAM,WAAA,GAAc,CAAC,OAAA,KAA6B;AACjD,EAAA,IAAI,OAAA,CAAQ,gBAAA,IAAmB,KAAM,KAAA,EAAO,OAAO,IAAA;AACnD,EAAA,MAAM,EAAE,WAAW,SAAA,EAAW,WAAA,KAC7B,OAAA,CAAQ,qBAAA,QAA6B,EAAC;AACvC,EAAA,OAAO,CAAC,SAAA,EAAW,SAAA,EAAW,WAAW,CAAA,CAAE,KAAK,CAAC,KAAA,KAAU,CAAC,CAAC,KAAK,CAAA;AACnE,CAAA;AAeO,IAAM,cAAA,GAAiB,MAC7B,kBAAA,CAAmB;AAAA,EAClB,IAAA,EAAM,IAAA;AAAA,EACN,MAAM,MAAM;AACX,IAAA,MAAM,UAAU,kBAAA,EAAmB;AACnC,IAAA,IACC,OAAO,SAAS,0BAAA,KAA+B,UAAA,IAC9C,QAAQ,aAAA,KAAkB,MAAA,IAC1B,OAAA,CAAQ,aAAA,KAAkB,QAAA,EAC1B;AACD,MAAA,OAAO,IAAA;AAAA,IACR;AACA,IAAA,MAAM,GAAA,GAAM,OAAA;AACZ,IAAA,IAAI,CAAC,WAAA,CAAY,GAAG,CAAA,EAAG,OAAO,IAAA;AAC9B,IAAA,OAAO;AAAA,MACN,WAAA,EAAa,IAAI,4BAAA,EAA6B;AAAA,MAC9C,SAAA,EAAW,IAAI,0BAAA,EAA2B;AAAA,MAC1C,SAAA,EAAW,GAAA,CAAI,gBAAA,EAAiB,IAAK,IAAI,iBAAA;AAAkB,KAC5D;AAAA,EACD,CAAA;AAAA,EACA,MAAA,EAAQ,CAAC,0BAAA,EAA4B,yBAAyB,CAAA;AAAA,EAC9D,QAAQ,MAAM;AACf,CAAC;AA6BK,IAAM,yBAAyB,CAAC;AAAA,EACtC,UAAA,GAAa;AACd,CAAA,GAAmC,EAAC,KAA8B;AACjE,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,eAAA;AACJ,EAAA,MAAM,QAAA,GAAW,IAAI,OAAA,CAAc,CAAC,OAAA,KAAY;AAC/C,IAAA,eAAA,GAAkB,OAAA;AAAA,EACnB,CAAC,CAAA;AAGD,EAAA,MAAM,kBAAA,GAAqB,CAAC,OAAA,EAAkB,QAAA,GAAW,UACxD,IAAI,OAAA,CAAc,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,UAAU,kBAAA,EAAmB;AACnC,IAAA,IAAI,CAAC,SAAS,kBAAA,EAAoB;AACjC,MAAA,IAAI,QAAA,EAAU;AACb,QAAA,MAAA,CAAO,IAAI,KAAA,CAAM,+CAA+C,CAAC,CAAA;AAAA,MAClE,CAAA,MAAO;AACN,QAAA,OAAA,EAAQ;AAAA,MACT;AACA,MAAA;AAAA,IACD;AACA,IAAA,OAAA,CAAQ,kBAAA;AAAA,MACP;AAAA,QACC,WAAW,OAAA,CAAQ,SAAA;AAAA,QACnB,WAAW,OAAA,CAAQ,SAAA;AAAA,QACnB,aAAa,OAAA,CAAQ,WAAA;AAAA,QACrB,cACC,OAAO,UAAA,KAAe,UAAA,GAAa,UAAA,CAAW,OAAO,CAAA,GAAI;AAAA,OAC3D;AAAA,MACA,CAAC,MAAA,KAAW;AACX,QAAA,IAAI,QAAQ,KAAA,EAAO,MAAA,CAAO,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,aAC5C,OAAA,EAAQ;AAAA,MACd;AAAA,KACD;AAAA,EACD,CAAC,CAAA;AAEF,EAAA,OAAO;AAAA,IACN,IAAA,EAAM,IAAA;AAAA,IACN,KAAA,EAAO,CAAC,OAAA,KAAY;AACnB,MAAA,MAAA,GAAS,OAAA;AACT,MAAA,eAAA,EAAgB;AAChB,MAAA,OAAO,mBAAmB,OAAO,CAAA;AAAA,IAClC,CAAA;AAAA,IACA,aAAa,YAAY;AACxB,MAAA,MAAM,OAAA,GACL,cAAA,IAAkB,MAAA,KAAW,MAAA,GAC1B,WAAW,MAAM;AACjB,QAAA,OAAA,CAAQ,IAAA;AAAA,UACP;AAAA,SACD;AAAA,MACD,CAAA,EAAG,kBAAkB,CAAA,GACpB,MAAA;AACJ,MAAA,MAAM,QAAA;AACN,MAAA,YAAA,CAAa,OAAO,CAAA;AACpB,MAAA,MAAM,kBAAA,CAAmB,QAAS,IAAI,CAAA;AAAA,IACvC;AAAA,GACD;AACD","file":"index.js","sourcesContent":["import { IS_DEVELOPMENT } from \"../../config\";\nimport type { Consent, ConsentSource, ConsentTarget } from \"../consent\";\nimport { eventConsentSource } from \"../event-consent-source\";\n\nconst NAME = \"shopify\";\n\n// Long enough for most visitors to answer the banner, so the warning points at a setup error.\nconst SYNC_WARNING_DELAY = 10_000;\n\ntype VisitorConsentValue = \"yes\" | \"no\" | \"\";\n\ntype CustomerPrivacy = {\n\t/** Set by Hydrogen's `<ShopifyScripts>`, `\"loaded\"` once the visitor's consent has been fetched. */\n\tconsentStatus?: string;\n\tanalyticsProcessingAllowed: () => boolean;\n\tmarketingAllowed: () => boolean;\n\tpreferencesProcessingAllowed: () => boolean;\n\tsaleOfDataAllowed: () => boolean;\n\tshouldShowBanner?: () => boolean;\n\tcurrentVisitorConsent?: () => Partial<\n\t\tRecord<\n\t\t\t\"analytics\" | \"marketing\" | \"preferences\" | \"sale_of_data\",\n\t\t\tVisitorConsentValue\n\t\t>\n\t>;\n\tsetTrackingConsent?: (\n\t\tconsent: Record<\n\t\t\t\"analytics\" | \"marketing\" | \"preferences\" | \"sale_of_data\",\n\t\t\tboolean\n\t\t>,\n\t\tcallback: (result?: { error?: string }) => void,\n\t) => void;\n};\n\nconst getCustomerPrivacy = () =>\n\t(window as { Shopify?: { customerPrivacy?: Partial<CustomerPrivacy> } })\n\t\t.Shopify?.customerPrivacy;\n\nconst hasAnswered = (privacy: CustomerPrivacy) => {\n\tif (privacy.shouldShowBanner?.() === false) return true;\n\tconst { analytics, marketing, preferences } =\n\t\tprivacy.currentVisitorConsent?.() ?? {};\n\treturn [analytics, marketing, preferences].some((value) => !!value);\n};\n\n/**\n * Consent from Shopify's Customer Privacy API, e.g. collected by Shopify's privacy banner through\n * `<ShopifyScripts consent={{ mode: \"default-banner\" }} />`. Answered once the visitor responds, or straight away where\n * Shopify shows no banner. `marketing` needs both `marketing` and `sale_of_data`, so an opt-out of data sale also stops\n * third-party ad tags, as Shopify does for pixels that count as a sale.\n *\n * @see https://shopify.dev/docs/api/customer-privacy\n *\n * @example\n * ```ts\n * export const analytics = createAnalytics({ consent: shopifyConsent(), destinations: [shopifyDestination()] });\n * ```\n */\nexport const shopifyConsent = (): ConsentSource =>\n\teventConsentSource({\n\t\tname: NAME,\n\t\tread: () => {\n\t\t\tconst privacy = getCustomerPrivacy();\n\t\t\tif (\n\t\t\t\ttypeof privacy?.analyticsProcessingAllowed !== \"function\" ||\n\t\t\t\t(privacy.consentStatus !== undefined &&\n\t\t\t\t\tprivacy.consentStatus !== \"loaded\")\n\t\t\t) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\tconst api = privacy as CustomerPrivacy;\n\t\t\tif (!hasAnswered(api)) return null;\n\t\t\treturn {\n\t\t\t\tpreferences: api.preferencesProcessingAllowed(),\n\t\t\t\tanalytics: api.analyticsProcessingAllowed(),\n\t\t\t\tmarketing: api.marketingAllowed() && api.saleOfDataAllowed(),\n\t\t\t};\n\t\t},\n\t\tevents: [\"consentTrackingApiLoaded\", \"visitorConsentCollected\"],\n\t\ttarget: () => document,\n\t});\n\nexport type ShopifyCustomerPrivacyOptions = {\n\t/**\n\t * What to set `sale_of_data` to, which no category covers. Default `false`. Pass `(consent) => consent.marketing` to\n\t * have it follow marketing.\n\t */\n\tsaleOfData?: boolean | ((consent: Consent) => boolean);\n};\n\nexport type ShopifyCustomerPrivacy = ConsentTarget & {\n\t/**\n\t * Pass to `<ShopifyScripts consent={{ mode: \"custom-banner\", setup }} />`. Resolves once the visitor's answer has\n\t * reached the Customer Privacy API, which releases Hydrogen's analytics bus.\n\t */\n\tsyncConsent: () => Promise<void>;\n};\n\n/**\n * Tells Shopify's Customer Privacy API the visitor's consent, so Shopify's scripts and checkout follow it: `preferences`,\n * `analytics` and `marketing` as they are, `sale_of_data` from `saleOfData`. Skipped when `shopifyConsent()` is the\n * source.\n *\n * @example\n * ```ts\n * export const customerPrivacy = shopifyCustomerPrivacy();\n * export const analytics = createAnalytics({ consent: cookiebotConsent(), consentTargets: [customerPrivacy] });\n * ```\n */\nexport const shopifyCustomerPrivacy = ({\n\tsaleOfData = false,\n}: ShopifyCustomerPrivacyOptions = {}): ShopifyCustomerPrivacy => {\n\tlet latest: Consent | undefined;\n\tlet resolveAnswered: () => void;\n\tconst answered = new Promise<void>((resolve) => {\n\t\tresolveAnswered = resolve;\n\t});\n\n\t// Without the API, skipped unless `required`: `syncConsent` sends the latest answer once it has loaded.\n\tconst setTrackingConsent = (consent: Consent, required = false) =>\n\t\tnew Promise<void>((resolve, reject) => {\n\t\t\tconst privacy = getCustomerPrivacy();\n\t\t\tif (!privacy?.setTrackingConsent) {\n\t\t\t\tif (required) {\n\t\t\t\t\treject(new Error(\"Shopify's Customer Privacy API hasn't loaded.\"));\n\t\t\t\t} else {\n\t\t\t\t\tresolve();\n\t\t\t\t}\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tprivacy.setTrackingConsent(\n\t\t\t\t{\n\t\t\t\t\tanalytics: consent.analytics,\n\t\t\t\t\tmarketing: consent.marketing,\n\t\t\t\t\tpreferences: consent.preferences,\n\t\t\t\t\tsale_of_data:\n\t\t\t\t\t\ttypeof saleOfData === \"function\" ? saleOfData(consent) : saleOfData,\n\t\t\t\t},\n\t\t\t\t(result) => {\n\t\t\t\t\tif (result?.error) reject(new Error(result.error));\n\t\t\t\t\telse resolve();\n\t\t\t\t},\n\t\t\t);\n\t\t});\n\n\treturn {\n\t\tname: NAME,\n\t\tapply: (consent) => {\n\t\t\tlatest = consent;\n\t\t\tresolveAnswered();\n\t\t\treturn setTrackingConsent(consent);\n\t\t},\n\t\tsyncConsent: async () => {\n\t\t\tconst warning =\n\t\t\t\tIS_DEVELOPMENT && latest === undefined\n\t\t\t\t\t? setTimeout(() => {\n\t\t\t\t\t\t\tconsole.warn(\n\t\t\t\t\t\t\t\t'[consent] shopifyCustomerPrivacy().syncConsent is still waiting for an answer. It never gets one when shopifyConsent() is the source: use <ShopifyScripts consent={{ mode: \"default-banner\" }} /> then.',\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t}, SYNC_WARNING_DELAY)\n\t\t\t\t\t: undefined;\n\t\t\tawait answered;\n\t\t\tclearTimeout(warning);\n\t\t\tawait setTrackingConsent(latest!, true);\n\t\t},\n\t};\n};\n"]}

package/dist/cookies/index.d.ts

@@ -0,0 +1,230 @@
+/**
+ * Every cookie attribute a store can write. Mirrors the options of Next.js' `cookies().set()`.
+ */
+type CookieAttributes = {
+    /** @default "/" */
+    path?: string;
+    domain?: string;
+    /** Lifetime in seconds, relative to the moment the cookie is written. */
+    maxAge?: number;
+    /** Absolute expiry. A `number` is a unix timestamp in milliseconds. */
+    expires?: Date | number;
+    secure?: boolean;
+    /** `"none"` requires `secure: true`, browsers reject the cookie otherwise. */
+    sameSite?: "lax" | "strict" | "none";
+    /** Hides the cookie from client-side JavaScript. Can only be written on the server. */
+    httpOnly?: boolean;
+    partitioned?: boolean;
+    priority?: "low" | "medium" | "high";
+};
+/**
+ * Anything cookies can be read from.
+ *
+ * Satisfied by:
+ * - `await cookies()` from `next/headers` (server components, server actions, route handlers)
+ * - `request.cookies` in Next.js proxy / middleware (`NextRequest`)
+ * - `response.cookies` in Next.js proxy / middleware / route handlers (`NextResponse`)
+ * - `browserCookies` from `@buildinams/core/cookies` (client)
+ */
+type CookieReader = {
+    get(name: string): {
+        value: string;
+    } | undefined;
+};
+/**
+ * Anything cookies can be written to.
+ *
+ * Satisfied by:
+ * - `await cookies()` from `next/headers`, in server actions and route handlers only (Next.js throws in server components)
+ * - `response.cookies` in Next.js proxy / middleware / route handlers (`NextResponse`)
+ * - `browserCookies` from `@buildinams/core/cookies` (client)
+ */
+type CookieWriter = {
+    set(name: string, value: string, attributes?: CookieAttributes): unknown;
+};
+declare const BROWSER_STORE: unique symbol;
+/** Marks `browserCookies`, so server-only cookies can reject it at compile time. */
+type BrowserBrand = {
+    readonly [BROWSER_STORE]: true;
+};
+/** A `CookieReader` that isn't `browserCookies`. Every Next.js cookie store qualifies. */
+type ServerCookieReader = CookieReader & {
+    readonly [BROWSER_STORE]?: never;
+};
+/** A `CookieWriter` that isn't `browserCookies`. Every writable Next.js cookie store qualifies. */
+type ServerCookieWriter = CookieWriter & {
+    readonly [BROWSER_STORE]?: never;
+};
+
+type Listener = () => void;
+type BrowserCookieStore = CookieReader & CookieWriter & BrowserBrand & {
+    /** Calls `listener` whenever cookies may have changed. Returns an unsubscribe function. */
+    subscribe(listener: Listener): () => void;
+};
+/**
+ * Client-side cookie store backed by `document.cookie`. Implements `CookieReader` and `CookieWriter`, so it can be
+ * passed to any cookie definition: `themeCookie.get(browserCookies)`.
+ *
+ * Reads and writes are synchronous. Values are URL-encoded the same way Next.js does, so cookies written here can be
+ * read on the server and vice versa.
+ */
+declare const browserCookies: BrowserCookieStore;
+
+/**
+ * Converts between a typed value and the raw string stored in the cookie.
+ *
+ * - `parse` receives the decoded cookie string and must **throw** when the value is invalid.
+ *   Cookies are user-controlled input, so an invalid value is treated as "cookie not set".
+ * - `serialize` turns a typed value into a string. URL-encoding is handled by the cookie store, don't encode here.
+ *
+ * Structurally compatible with `Schema<Value, string>` from `@buildinams/core/schema`.
+ *
+ * @example
+ * ```ts
+ * const dateSchema: CookieSchema<Date> = {
+ *   parse: (raw) => {
+ *     const date = new Date(raw);
+ *     if (Number.isNaN(date.getTime())) throw new Error("Invalid date");
+ *     return date;
+ *   },
+ *   serialize: (value) => value.toISOString(),
+ * };
+ * ```
+ */
+type CookieSchema<Value> = {
+    parse: (raw: string) => Value;
+    serialize: (value: Value) => string;
+};
+/**
+ * Ready-made `CookieSchema`s for common value types.
+ *
+ * @example
+ * ```ts
+ * cookieSchema.string();                    // string
+ * cookieSchema.number();                    // number
+ * cookieSchema.boolean();                   // boolean
+ * cookieSchema.enum(["light", "dark"]);     // "light" | "dark"
+ * cookieSchema.json(ConsentSchema.parse);   // z.infer<typeof ConsentSchema>
+ * ```
+ */
+declare const cookieSchema: {
+    string: () => CookieSchema<string>;
+    /** Finite numbers only. */
+    number: () => CookieSchema<number>;
+    /** Stored as `"true"` / `"false"`. */
+    boolean: () => CookieSchema<boolean>;
+    /** One of a fixed set of string literals. */
+    enum: <const Values extends readonly [string, ...string[]]>(values: Values) => CookieSchema<Values[number]>;
+    /**
+     * JSON-encoded value. `validate` receives the result of `JSON.parse` and must return the typed value or throw.
+     * A zod/valibot/etc. `parse` function fits directly.
+     *
+     * @example
+     * ```ts
+     * cookieSchema.json(z.object({ analytics: z.boolean() }).parse);
+     *
+     * // without a validation library
+     * cookieSchema.json((input) => {
+     *   if (typeof input !== "object" || input === null || !("analytics" in input)) throw new Error();
+     *   return { analytics: input.analytics === true };
+     * });
+     * ```
+     */
+    json: <Value>(validate: (input: unknown) => Value) => CookieSchema<Value>;
+};
+
+/**
+ * Attributes fixed on a cookie definition, applied to every write and to `delete()`.
+ */
+type CookieOptions = Omit<CookieAttributes, "expires">;
+/**
+ * Per-write lifetime overrides. Path, domain etc. stay on the definition so `delete()` always hits the same cookie.
+ */
+type CookieWriteOptions = Pick<CookieAttributes, "maxAge" | "expires">;
+type ReadValue<Value, HasDefault extends boolean> = HasDefault extends true ? Value : Value | null;
+/**
+ * A typed cookie readable and writable on the server and in the browser. Create with `defineCookie()`.
+ *
+ * - `Value`: the type written and read.
+ * - `HasDefault`: `true` when a `defaultValue` is defined. Reads return `Value`, otherwise `Value | null`.
+ */
+type Cookie<Value, HasDefault extends boolean = boolean> = {
+    readonly name: string;
+    readonly httpOnly: false;
+    /** Reads and parses the cookie. Returns the default (or `null`) when it is missing or invalid. */
+    get(store: CookieReader): ReadValue<Value, HasDefault>;
+    /** Serializes and writes the cookie with the definition's options. */
+    set(store: CookieWriter, value: Value, options?: CookieWriteOptions): void;
+    /** Expires the cookie. */
+    delete(store: CookieWriter): void;
+};
+/**
+ * A typed httpOnly cookie. Same API as `Cookie`, but only accepts server stores: passing `browserCookies` is a
+ * compile error, since the browser can't read or write it.
+ */
+type ServerCookie<Value, HasDefault extends boolean = boolean> = {
+    readonly name: string;
+    readonly httpOnly: true;
+    get(store: ServerCookieReader): ReadValue<Value, HasDefault>;
+    set(store: ServerCookieWriter, value: Value, options?: CookieWriteOptions): void;
+    delete(store: ServerCookieWriter): void;
+};
+/**
+ * The type written to a cookie.
+ *
+ * @example
+ * ```ts
+ * type Theme = CookieWriteValue<typeof themeCookie>; // "light" | "dark"
+ * ```
+ */
+type CookieWriteValue<T extends Cookie<any> | ServerCookie<any>> = Parameters<T["set"]>[1];
+/**
+ * The type read from a cookie: `CookieWriteValue | null` when there is no `defaultValue`.
+ */
+type CookieReadValue<T extends Cookie<any> | ServerCookie<any>> = ReturnType<T["get"]>;
+type CookieConfig<Value, HttpOnly extends boolean> = {
+    /** Cookie name, as stored in the browser. */
+    name: string;
+    /** How to convert between the typed value and the stored string. See `cookieSchema`. */
+    schema: CookieSchema<Value>;
+    /** Attributes used for every write. `path` defaults to `"/"`. */
+    options?: Omit<CookieOptions, "httpOnly"> & {
+        httpOnly?: HttpOnly;
+    };
+};
+type DefinedCookie<Value, HasDefault extends boolean, HttpOnly extends boolean> = HttpOnly extends true ? ServerCookie<Value, HasDefault> : Cookie<Value, HasDefault>;
+/**
+ * Defines a typed cookie that can be read and written with the same API on the server (Next.js) and on the client.
+ * With `options.httpOnly: true` it returns a `ServerCookie`, which rejects `browserCookies` at compile time.
+ *
+ * Define it next to the code it belongs to (e.g. `src/features/auth/cookies.ts`), in a module without
+ * `"use client"` / `"use server"`, so both environments can import it.
+ *
+ * @example
+ * ```ts
+ * import { cookieSchema, defineCookie } from "@buildinams/core/cookies";
+ *
+ * export const themeCookie = defineCookie({
+ *   name: "theme",
+ *   schema: cookieSchema.enum(["light", "dark"]),
+ *   defaultValue: "light",
+ *   options: { maxAge: 60 * 60 * 24 * 365, sameSite: "lax" },
+ * });
+ *
+ * // server component / server action / route handler
+ * const theme = themeCookie.get(await cookies()); // "light" | "dark"
+ * themeCookie.set(await cookies(), "dark"); // server action / route handler only
+ *
+ * // client
+ * themeCookie.set(browserCookies, "dark");
+ * const theme = useCookieValue(themeCookie); // @buildinams/react/cookies
+ * ```
+ */
+declare function defineCookie<Value, HttpOnly extends boolean = false>(config: CookieConfig<Value, HttpOnly> & {
+    defaultValue: NoInfer<Value>;
+}): DefinedCookie<Value, true, HttpOnly>;
+declare function defineCookie<Value, HttpOnly extends boolean = false>(config: CookieConfig<Value, HttpOnly> & {
+    defaultValue?: undefined;
+}): DefinedCookie<Value, false, HttpOnly>;
+
+export { type Cookie, type CookieAttributes, type CookieOptions, type CookieReadValue, type CookieReader, type CookieSchema, type CookieWriteOptions, type CookieWriteValue, type CookieWriter, type ServerCookie, type ServerCookieReader, type ServerCookieWriter, browserCookies, cookieSchema, defineCookie };