@c15t/svelte 3.0.0-alpha.0

package/dist/iab-types.js

@@ -0,0 +1,43 @@
+/**
+ * The Svelte adapter's view of the shared IAB display model.
+ *
+ * The derivation itself — which purposes a stack absorbs, which rows a
+ * preference centre lists, what each row's test-id is — lives in
+ * `@c15t/iab/headless` so React, Svelte, Vue and the Astro server render
+ * cannot drift apart. This module is the thin naming layer that was left
+ * behind: the local type aliases the components already import, and two
+ * wrappers keeping the argument shapes they already call with.
+ *
+ * `@c15t/iab/headless` is pure derivation with no TCF encoder behind it,
+ * so importing it here does not pull the CMP API into an app that never
+ * mounts an IAB surface — the components that import this module are
+ * themselves only reachable from `<IABConsentBanner>`/`<IABConsentDialog>`.
+ */
+import { processGVLForDialog, resolveIABBannerSummary, } from '@c15t/iab/headless';
+export { resolveIABDialogDisplayModel } from '@c15t/iab/headless';
+/**
+ * Process raw GVL data into UI-friendly format.
+ *
+ * @param gvl - The Global Vendor List.
+ * @param customVendors - Publisher-declared non-IAB vendors.
+ * @returns The processed purposes, stacks, features and vendors.
+ */
+export const processGVLData = function processGVLData(gvl, customVendors = []) {
+    return processGVLForDialog({ customVendors, gvl });
+};
+/**
+ * Compute display items for the IAB consent banner.
+ *
+ * @param gvl - The Global Vendor List.
+ * @param maxItems - How many items to list before collapsing the rest.
+ * Defaults to the cap the shared model applies, so the four banners list
+ * the same number of items unless a caller asks otherwise.
+ * @returns The item names to list, and how many were left out.
+ */
+export const getIABBannerDisplayItems = function getIABBannerDisplayItems(gvl, maxItems) {
+    const summary = resolveIABBannerSummary({ gvl }, { maxItems });
+    return {
+        displayed: summary.displayItems,
+        remainingCount: summary.remainingCount,
+    };
+};

package/dist/index.d.ts

@@ -0,0 +1,28 @@
+export { custom, defaultTranslationConfig, detectBrowserLanguage, hosted, mergeTranslationConfigs, prepareTranslationConfig, } from '@c15t/core';
+export type { AllConsentNames, ConsentType, I18nConfig, LegalLinks, Translations, ConsentKernel, ConsentSnapshot, ConsentState, GlobalVendorList, InitResponse, KernelActiveUI, KernelBranding, KernelConfig, KernelEvent, KernelIABState, KernelModel, KernelOverrides, KernelTranslations, KernelTransport, KernelUser, LocationResponse, NonIABVendor, PolicyScopeMode, HostedModeOptions, ProviderTransportContext, ProviderTransportFactory, ProviderTransportKind, SavePayload, SaveResult, TranslationsResponse, } from '@c15t/core';
+export { createConsentRuntime } from '@c15t/core/runtime';
+export type { ConsentRuntime, ConsentRuntimeIABFactory, ConsentRuntimeIABHandle, ConsentRuntimeOptions, } from '@c15t/core/runtime';
+export * from '@c15t/ui/primitives';
+export * from '@c15t/ui/styles/primitives';
+export type { ColorTokens, ComponentSlots, MotionTokens, RadiusTokens, ShadowTokens, SlotStyle, SpacingTokens, Theme, TypographyTokens, } from '@c15t/ui/theme';
+export { focusTrap } from './actions/focus-trap';
+export { portal } from './actions/portal';
+export { scrollLock } from './actions/scroll-lock';
+export { default as ConsentBanner } from './components/prompt.svelte';
+export { default as ConsentButton } from './components/action-button.svelte';
+export { default as ConsentDialog } from './components/panel.svelte';
+export { default as ConsentDialogLink } from './components/panel-link.svelte';
+export { default as ConsentDialogTrigger } from './components/panel-trigger.svelte';
+export { default as ConsentManagerProvider } from './components/manager-provider.svelte';
+export { default as ConsentWidget } from './components/preferences.svelte';
+export { default as Frame } from './components/frame.svelte';
+export { default as IABConsentBanner } from './components/iab-prompt.svelte';
+export { default as IABConsentDialog } from './components/iab-panel.svelte';
+export { getConsentKernel, getConsentManager, getHeadlessConsent, getIAB, getSnapshot, type HeadlessConsentSurfaceState, type SvelteIABState, } from './context.svelte';
+export { Accordion, Collapsible, Dialog, Portal, PreferenceItem, Switch, Tabs, } from './primitives';
+export type { ConsentManagerOptions, ConsentProviderCallbacks, ProviderIABOptions, SvelteUIOptions, UseNetworkBlockerOptions, UsePersistenceOptions, UseScriptLoaderOptions, } from './types';
+export type { OfflineModeOptions } from './transports/offline';
+export { offline } from './transports/offline';
+export type { ConsentManagerState, ConsentDraftState } from './context.svelte';
+export { resolveConsentPresentation } from '@c15t/core';
+export type { ConsentPresentation, PresentationAction, ResolvedConsentPresentation, } from '@c15t/core';

package/dist/index.js

@@ -0,0 +1,21 @@
+export { custom, defaultTranslationConfig, detectBrowserLanguage, hosted, mergeTranslationConfigs, prepareTranslationConfig, } from '@c15t/core';
+export { createConsentRuntime } from '@c15t/core/runtime';
+export * from '@c15t/ui/primitives';
+export * from '@c15t/ui/styles/primitives';
+export { focusTrap } from './actions/focus-trap';
+export { portal } from './actions/portal';
+export { scrollLock } from './actions/scroll-lock';
+export { default as ConsentBanner } from './components/prompt.svelte';
+export { default as ConsentButton } from './components/action-button.svelte';
+export { default as ConsentDialog } from './components/panel.svelte';
+export { default as ConsentDialogLink } from './components/panel-link.svelte';
+export { default as ConsentDialogTrigger } from './components/panel-trigger.svelte';
+export { default as ConsentManagerProvider } from './components/manager-provider.svelte';
+export { default as ConsentWidget } from './components/preferences.svelte';
+export { default as Frame } from './components/frame.svelte';
+export { default as IABConsentBanner } from './components/iab-prompt.svelte';
+export { default as IABConsentDialog } from './components/iab-panel.svelte';
+export { getConsentKernel, getConsentManager, getHeadlessConsent, getIAB, getSnapshot, } from './context.svelte';
+export { Accordion, Collapsible, Dialog, Portal, PreferenceItem, Switch, Tabs, } from './primitives';
+export { offline } from './transports/offline';
+export { resolveConsentPresentation } from '@c15t/core';

package/dist/kit/app.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Ambient `App.Locals` augmentation for apps that install `c15tHandle`.
+ *
+ * Reference it once from `src/app.d.ts`:
+ *
+ * ```ts
+ * /// <reference types="@c15t/svelte/kit/locals" />
+ * ```
+ *
+ * Prefer the explicit form if you already own an `App.Locals` block:
+ *
+ * ```ts
+ * import type { C15tLocals } from '@c15t/svelte/kit';
+ *
+ * declare global {
+ *   namespace App {
+ *     interface Locals {
+ *       c15t: C15tLocals;
+ *     }
+ *   }
+ * }
+ * ```
+ */
+import type { C15tLocals } from './types';
+
+declare global {
+	namespace App {
+		interface Locals {
+			/** Consent context resolved once per request by `c15tHandle`. */
+			c15t: C15tLocals;
+		}
+	}
+}
+
+export {};

package/dist/kit/handle.d.ts

@@ -0,0 +1,34 @@
+import type { Handle } from '@sveltejs/kit';
+import type { ConsentRequestOptions } from './types';
+/** Options for {@link c15tHandle}. */
+export type C15tHandleOptions = ConsentRequestOptions;
+/**
+ * Creates the c15t SvelteKit handle.
+ *
+ * Register it in `src/hooks.server.ts`, alone or composed with `sequence()`:
+ *
+ * ```ts
+ * import { c15tHandle } from '@c15t/svelte/kit';
+ * import { sequence } from '@sveltejs/kit/hooks';
+ *
+ * export const handle = sequence(c15tHandle(), myOtherHandle);
+ * ```
+ *
+ * Augment `App.Locals` so `event.locals.c15t` is typed:
+ *
+ * ```ts
+ * import type { C15tLocals } from '@c15t/svelte/kit';
+ *
+ * declare global {
+ *   namespace App {
+ *     interface Locals {
+ *       c15t: C15tLocals;
+ *     }
+ *   }
+ * }
+ * ```
+ *
+ * @param options - Cookie name and geo/language overrides.
+ * @returns A `Handle` that populates `event.locals.c15t`.
+ */
+export declare const c15tHandle: (options?: C15tHandleOptions) => Handle;

package/dist/kit/handle.js

@@ -0,0 +1,87 @@
+import { extractConsentRequestInputs } from '@c15t/schema/types';
+import { readInitialConsentConfig } from '../server';
+/**
+ * Rewrites the resolved inputs back onto the request as the canonical
+ * `x-c15t-*` / `sec-gpc` headers, so anything downstream that reads raw
+ * headers (a proxied backend call, a nested handle) sees one normalized
+ * shape instead of whichever CDN header happened to carry it.
+ *
+ * Request headers are immutable in some runtimes. When the write is refused
+ * the normalized values are still on `event.locals.c15t.inputs`, which is
+ * what every helper in this package reads, so the request continues.
+ */
+const normalizeRequestHeaders = function normalizeRequestHeaders(headers, inputs) {
+    try {
+        if (inputs.country) {
+            headers.set('x-c15t-country', inputs.country);
+        }
+        if (inputs.region) {
+            headers.set('x-c15t-region', inputs.region);
+        }
+        if (inputs.language) {
+            // The resolved language, not the browser's list: a downstream
+            // route re-reads `accept-language`, and an `options.language`
+            // override has to reach it too.
+            headers.set('accept-language', inputs.language);
+        }
+        if (inputs.gpc !== undefined) {
+            headers.set('sec-gpc', inputs.gpc ? '1' : '0');
+        }
+    }
+    catch {
+        // Immutable headers — locals still carry the normalized inputs.
+    }
+};
+/**
+ * Creates the c15t SvelteKit handle.
+ *
+ * Register it in `src/hooks.server.ts`, alone or composed with `sequence()`:
+ *
+ * ```ts
+ * import { c15tHandle } from '@c15t/svelte/kit';
+ * import { sequence } from '@sveltejs/kit/hooks';
+ *
+ * export const handle = sequence(c15tHandle(), myOtherHandle);
+ * ```
+ *
+ * Augment `App.Locals` so `event.locals.c15t` is typed:
+ *
+ * ```ts
+ * import type { C15tLocals } from '@c15t/svelte/kit';
+ *
+ * declare global {
+ *   namespace App {
+ *     interface Locals {
+ *       c15t: C15tLocals;
+ *     }
+ *   }
+ * }
+ * ```
+ *
+ * @param options - Cookie name and geo/language overrides.
+ * @returns A `Handle` that populates `event.locals.c15t`.
+ */
+export const c15tHandle = function c15tHandle(options = {}) {
+    return async ({ event, resolve }) => {
+        const { headers } = event.request;
+        const inputs = extractConsentRequestInputs(headers, {
+            country: options.country,
+            language: options.language,
+            region: options.region,
+        });
+        normalizeRequestHeaders(headers, inputs);
+        const config = await readInitialConsentConfig({
+            cookieName: options.cookieName,
+            country: inputs.country,
+            headers,
+            language: inputs.language,
+            region: inputs.region,
+        });
+        const locals = { config, inputs };
+        if (options.cookieName !== undefined) {
+            locals.cookieName = options.cookieName;
+        }
+        event.locals.c15t = locals;
+        return resolve(event);
+    };
+};

package/dist/kit/index.d.ts

@@ -0,0 +1,30 @@
+/**
+ * `@c15t/svelte/kit` — the SvelteKit server layer.
+ *
+ * Server-only. Importing this from a component that runs in the browser will
+ * pull `@c15t/translations/all` and the manifest resolver into the client
+ * bundle; keep it to `hooks.server.ts`, `+*.server.ts`, and `+server.ts`.
+ *
+ * ```ts
+ * // src/hooks.server.ts
+ * export const handle = c15tHandle();
+ *
+ * // src/routes/api/c15t/[...path]/+server.ts
+ * export const { GET } = createSvelteKitConsentRouteHandlers({ backendURL });
+ *
+ * // src/routes/+layout.server.ts
+ * export const load = async (event) => ({
+ *   prefetch: await loadConsent(event, { initRoute: '/api/c15t' }),
+ * });
+ * ```
+ */
+export type { C15tHandleOptions } from './handle';
+export { c15tHandle } from './handle';
+export type { LoadConsentOptions } from './load-consent';
+export { loadConsent } from './load-consent';
+export type { SvelteKitConsentRouteOptions } from './routes';
+export { createSvelteKitConsentRouteHandlers } from './routes';
+export type { C15tLocals, ConsentManifestOptions, ConsentRequestInputs, ConsentRequestOptions, } from './types';
+export type { KernelConfig } from '@c15t/core';
+export { custom, hosted } from '@c15t/core';
+export { offline } from '../transports/offline';

package/dist/kit/index.js

@@ -0,0 +1,5 @@
+export { c15tHandle } from './handle';
+export { loadConsent } from './load-consent';
+export { createSvelteKitConsentRouteHandlers } from './routes';
+export { custom, hosted } from '@c15t/core';
+export { offline } from '../transports/offline';

package/dist/kit/load-consent.d.ts

@@ -0,0 +1,57 @@
+import type { KernelConfig } from '@c15t/core';
+import type { RequestEvent } from '@sveltejs/kit';
+import type { ConsentRequestOptions } from './types';
+/** Options for {@link loadConsent}. */
+export interface LoadConsentOptions extends ConsentRequestOptions {
+    /**
+     * Hosted mode: the c15t backend base URL, absolute or origin-relative.
+     * `loadConsent` calls its `/init` directly.
+     */
+    backendURL?: string;
+    /**
+     * Manifest mode: the same-origin init route installed with
+     * {@link createSvelteKitConsentRouteHandlers}, e.g. `/api/c15t`.
+     * Takes precedence over `backendURL`.
+     *
+     * Fetched through `event.fetch`, so the request never leaves the process
+     * and SvelteKit forwards the page's cookies and headers for you.
+     */
+    initRoute?: string;
+    /** Extra request headers to forward upstream in hosted mode. */
+    forwardHeaders?: string[];
+    /** Fetch implementation for hosted mode. Defaults to `event.fetch`. */
+    fetch?: typeof globalThis.fetch;
+}
+/**
+ * Loads the consent prefetch for a request.
+ *
+ * ```ts
+ * // src/routes/+layout.server.ts
+ * import { loadConsent } from '@c15t/svelte/kit';
+ *
+ * export const load = async (event) => ({
+ *   prefetch: await loadConsent(event, { initRoute: '/api/c15t' }),
+ * });
+ * ```
+ *
+ * Then pass it straight through:
+ *
+ * ```svelte
+ * <ConsentManagerProvider prefetch={data.prefetch} mode={hosted({ url: '/api/c15t' })}>
+ * ```
+ *
+ * Modes:
+ * - `initRoute` — manifest mode. Resolves against the same-origin init route
+ *   in-process via `event.fetch`.
+ * - `backendURL` — hosted mode. Calls the backend's `/init` directly.
+ * - Neither — cookie and request context only. The client still initializes;
+ *   the server just has nothing extra to seed.
+ *
+ * Never throws: a failed upstream call degrades to the cookie-only config
+ * rather than taking the page down with it.
+ *
+ * @param event - The SvelteKit request event from `load`.
+ * @param options - Mode selection, cookie name, and geo/language overrides.
+ * @returns A serializable `KernelConfig` for the provider's `prefetch` prop.
+ */
+export declare const loadConsent: (event: RequestEvent, options?: LoadConsentOptions) => Promise<KernelConfig>;

package/dist/kit/load-consent.js

@@ -0,0 +1,144 @@
+import { deferInitGvl, c15tProtocolHeaders, mergeInitOutputIntoKernelConfig, } from '@c15t/core';
+/**
+ * `loadConsent` — the `+layout.server.ts` half of the SvelteKit layer.
+ *
+ * Returns a plain, serializable `KernelConfig` to hand the provider as
+ * `prefetch`. With a prefetch in hand the kernel resolves the policy on the
+ * server, so the banner is in the first HTML instead of appearing a frame
+ * after hydration.
+ */
+import { readProducerPolicyContract } from '@c15t/core/transports';
+import { extractConsentRequestInputs, headersToRecord, } from '@c15t/schema/types';
+import { prefetchInitialConsent, readInitialConsentConfig } from '../server';
+const readLocals = function readLocals(event) {
+    return event.locals.c15t;
+};
+/**
+ * Resolves the base config and request inputs: whatever {@link c15tHandle}
+ * already computed for this request, or a fresh cookie + header read when the
+ * handle is not installed.
+ *
+ * Per-call inputs beat the handle's. A route that passes `country` is naming
+ * the country for that page, and silently keeping the handle's would render
+ * one jurisdiction and forward another.
+ */
+const resolveBase = async function resolveBase(event, options) {
+    const overridesPerCall = options.cookieName !== undefined ||
+        options.country !== undefined ||
+        options.language !== undefined ||
+        options.region !== undefined;
+    const locals = readLocals(event);
+    // The handle's cookie name is part of the request context, not an
+    // override: a per-call `country` must not silently move the read back
+    // to the default `c15t` key and lose the persisted consent.
+    const cookieName = options.cookieName ?? locals?.cookieName;
+    if (locals && !overridesPerCall) {
+        return { ...locals, cookieName };
+    }
+    const inputs = extractConsentRequestInputs(event.request.headers, {
+        country: options.country,
+        language: options.language,
+        region: options.region,
+    });
+    const config = await readInitialConsentConfig({
+        cookieName,
+        country: inputs.country,
+        headers: event.request.headers,
+        language: inputs.language,
+        region: inputs.region,
+    });
+    return { config, cookieName, inputs };
+};
+/**
+ * Request headers for the same-origin init call.
+ *
+ * `event.fetch` only inherits `cookie` and `authorization`, so the geo,
+ * language and GPC context has to be restated explicitly — otherwise the init
+ * route resolves a different policy than the page did, and hydration corrects
+ * a banner the server already painted.
+ */
+const initRequestHeaders = function initRequestHeaders(inputs) {
+    const headers = { ...c15tProtocolHeaders };
+    if (inputs.country) {
+        headers['x-c15t-country'] = inputs.country;
+    }
+    if (inputs.region) {
+        headers['x-c15t-region'] = inputs.region;
+    }
+    if (inputs.language) {
+        headers['accept-language'] = inputs.language;
+    }
+    if (inputs.gpc !== undefined) {
+        headers['sec-gpc'] = inputs.gpc ? '1' : '0';
+    }
+    return headers;
+};
+/**
+ * Loads the consent prefetch for a request.
+ *
+ * ```ts
+ * // src/routes/+layout.server.ts
+ * import { loadConsent } from '@c15t/svelte/kit';
+ *
+ * export const load = async (event) => ({
+ *   prefetch: await loadConsent(event, { initRoute: '/api/c15t' }),
+ * });
+ * ```
+ *
+ * Then pass it straight through:
+ *
+ * ```svelte
+ * <ConsentManagerProvider prefetch={data.prefetch} mode={hosted({ url: '/api/c15t' })}>
+ * ```
+ *
+ * Modes:
+ * - `initRoute` — manifest mode. Resolves against the same-origin init route
+ *   in-process via `event.fetch`.
+ * - `backendURL` — hosted mode. Calls the backend's `/init` directly.
+ * - Neither — cookie and request context only. The client still initializes;
+ *   the server just has nothing extra to seed.
+ *
+ * Never throws: a failed upstream call degrades to the cookie-only config
+ * rather than taking the page down with it.
+ *
+ * @param event - The SvelteKit request event from `load`.
+ * @param options - Mode selection, cookie name, and geo/language overrides.
+ * @returns A serializable `KernelConfig` for the provider's `prefetch` prop.
+ */
+export const loadConsent = async function loadConsent(event, options = {}) {
+    const { config, inputs, cookieName } = await resolveBase(event, options);
+    if (options.initRoute) {
+        const forwarded = initRequestHeaders(inputs);
+        try {
+            const response = await event.fetch(options.initRoute, {
+                headers: forwarded,
+            });
+            if (!response.ok) {
+                return config;
+            }
+            const payload = (await response.json());
+            return mergeInitOutputIntoKernelConfig(config, deferInitGvl(payload, options.initRoute, 'init', forwarded), {
+                ...headersToRecord(event.request.headers),
+                ...forwarded,
+            }, { producerContract: readProducerPolicyContract(response.headers) });
+        }
+        catch {
+            // Fail soft: the client re-runs init on hydration.
+            return config;
+        }
+    }
+    if (options.backendURL) {
+        return prefetchInitialConsent({
+            backendURL: options.backendURL,
+            cookieName,
+            country: inputs.country,
+            fetch: options.fetch,
+            forwardHeaders: options.forwardHeaders,
+            frameworkFetch: event.fetch,
+            headers: event.request.headers,
+            language: inputs.language,
+            region: inputs.region,
+        });
+    }
+    return config;
+};

package/dist/kit/routes.d.ts

@@ -0,0 +1,46 @@
+import type { ConsentManifestGVLReference, GlobalVendorList } from '@c15t/schema/types';
+import type { RequestEvent, RequestHandler } from '@sveltejs/kit';
+import type { ConsentManifestOptions } from './types';
+/**
+ * Hands a promise to the `waitUntil` a SvelteKit adapter exposes on
+ * `event.platform.context` (Cloudflare Workers and Pages, Vercel edge), so a
+ * background refresh outlives the response on runtimes that would cancel
+ * it. A no-op where the adapter provides none.
+ */
+export declare const waitUntilFromEvent: (revalidation: Promise<void>, event: RequestEvent) => void;
+/** Options for {@link createSvelteKitConsentRouteHandlers}. */
+export interface SvelteKitConsentRouteOptions extends ConsentManifestOptions {
+    /**
+     * Fetches the Global Vendor List when the resolved policy is IAB.
+     * Defaults to a plain `GET` of the manifest's GVL reference.
+     */
+    fetchGvl?: (input: {
+        reference: ConsentManifestGVLReference;
+        language: string;
+        fetch: typeof globalThis.fetch;
+    }) => Promise<GlobalVendorList | null>;
+}
+/**
+ * Creates the SvelteKit request handlers for manifest mode.
+ *
+ * Two shapes are supported. A single catch-all route:
+ *
+ * ```ts
+ * // src/routes/api/c15t/[...path]/+server.ts
+ * import { createSvelteKitConsentRouteHandlers } from '@c15t/svelte/kit';
+ *
+ * export const { GET } = createSvelteKitConsentRouteHandlers({
+ *   backendURL: process.env.C15T_BACKEND_URL,
+ * });
+ * ```
+ *
+ * …or one file per route, using `init` and `manifest` directly.
+ *
+ * @param options - Manifest source, fetch implementation, GVL fetcher.
+ * @returns `init`, `manifest`, and a `GET` that dispatches between them.
+ */
+export declare const createSvelteKitConsentRouteHandlers: (options?: SvelteKitConsentRouteOptions) => {
+    GET: RequestHandler;
+    init: RequestHandler;
+    manifest: RequestHandler;
+};