@cartbase/storefront 0.14.0 → 0.16.0

package/src/reviews-ui/review-wizard.tsx

@@ -11,6 +11,7 @@ import {
 } from "../api/reviews"
 import { StoreApiError } from "../api/types"
 import { cn } from "../lib/utils"
+import { useLocaleArea } from "../locales/context"
 import { defaultReviewsUiLabels, type ReviewsUiLabels } from "./labels"
 import { MAX_BODY, firstNameOf, formatLabel } from "./helpers"
 import {
@@ -89,7 +90,7 @@ export function ReviewWizard({
   storeHref = "/",
   labels,
 }: ReviewWizardProps) {
-  const l = { ...defaultReviewsUiLabels, ...labels }
+  const l = { ...useLocaleArea("reviews", defaultReviewsUiLabels), ...labels }
   const entry = resolveWizardEntry(validation)
 
   // ── Invalid / expired ────────────────────────────────────────────────
@@ -254,7 +255,7 @@ export function ReviewWizardForm({
   initialRewardCode?: string | null
   labels?: Partial<ReviewsUiLabels>
 }) {
-  const l = { ...defaultReviewsUiLabels, ...labels }
+  const l = { ...useLocaleArea("reviews", defaultReviewsUiLabels), ...labels }
   const [step, setStep] = useState<WizardStep>(initialStep)
   const [rating, setRating] = useState<number>(0)
   const [hoverRating, setHoverRating] = useState<number>(0)

package/src/store/category-template.tsx

@@ -30,7 +30,14 @@ type CategoryTemplateProps = {
   /** From the `page` query param. */
   page?: string
   pricingContext?: PricingContextQuery
-  labels?: Partial<StoreLabels>
+  /**
+   * The store's pack for this area, REQUIRED: this is a server component and
+   * cannot read `StorefrontLocaleProvider`, so the page passes
+   * `STORE_LOCALE.store` (`en.store` for an English store). Required since
+   * 2026-09-14 so that forgetting it fails the build instead of shipping
+   * silent English.
+   */
+  labels: StoreLabels
   /** Override the default ProductPreview with a store-specific card. */
   renderProduct?: ProductCardComponent
 }

package/src/store/collection-template.tsx

@@ -46,7 +46,14 @@ type CollectionTemplateProps = {
   /** From the `page` query param. */
   page?: string
   pricingContext?: PricingContextQuery
-  labels?: Partial<StoreLabels>
+  /**
+   * The store's pack for this area, REQUIRED: this is a server component and
+   * cannot read `StorefrontLocaleProvider`, so the page passes
+   * `STORE_LOCALE.store` (`en.store` for an English store). Required since
+   * 2026-09-14 so that forgetting it fails the build instead of shipping
+   * silent English.
+   */
+  labels: StoreLabels
   /** Override the default ProductPreview with a store-specific card. */
   renderProduct?: ProductCardComponent
 }

package/src/store/paginated-products.tsx

@@ -48,8 +48,9 @@ export async function PaginatedProducts({
   client: StorefrontClient
   sortBy?: SortOptions
   page: number
-  /** Filters by PRIMARY collection (`products.collection_id`) — for the
-   *  membership join use collection-template / `listCollectionProducts`. */
+  /** Filters by collection MEMBERSHIP since 2026-09-15 (a product in three
+   *  collections is listed under all three). For the collection's OWN order
+   *  use collection-template / `listCollectionProducts`. */
   collectionId?: string
   categoryId?: string
   productsIds?: string[]

package/src/store/search-template.tsx

@@ -24,7 +24,7 @@ import { searchProducts } from "../api/search"
 import { cn } from "../lib/utils"
 import { Button } from "../primitives/ui/button"
 import { ProductPreview } from "../products/product-preview"
-import { defaultStoreLabels, type StoreLabels } from "./labels"
+import type { StoreLabels } from "./labels"
 import type { ProductCardComponent } from "./paginated-products"
 import { Pagination } from "./pagination"
 import {
@@ -50,7 +50,14 @@ type SearchTemplateProps = {
   pricingContext?: PricingContextQuery
   /** Page size, 1–100 (server default 20). */
   limit?: number
-  labels?: Partial<StoreLabels>
+  /**
+   * The store's pack for this area, REQUIRED: this is a server component and
+   * cannot read `StorefrontLocaleProvider`, so the page passes
+   * `STORE_LOCALE.store` (`en.store` for an English store). Required since
+   * 2026-09-14 so that forgetting it fails the build instead of shipping
+   * silent English, which is exactly how evoo's search page stayed English.
+   */
+  labels: StoreLabels
   /** Override the default ProductPreview with a store-specific card. */
   renderProduct?: ProductCardComponent
 }
@@ -61,10 +68,9 @@ export async function SearchTemplate({
   basePath = "/search",
   pricingContext,
   limit = DEFAULT_LIMIT,
-  labels,
+  labels: l,
   renderProduct: Card = ProductPreview,
 }: SearchTemplateProps) {
-  const l = { ...defaultStoreLabels, ...labels }
   const state = parseSearchParams(searchParams)
 
   let response: SearchProductsResponse | null = null

package/src/store/store-template.tsx

@@ -8,7 +8,7 @@ import { Suspense } from "react"
 import type { StorefrontClient } from "../api/http"
 import type { PricingContextQuery } from "../api/types"
 import type { SortOptions } from "../lib/sort-products"
-import { defaultStoreLabels, type StoreLabels } from "./labels"
+import type { StoreLabels } from "./labels"
 import { SortSelect } from "./sort-select"
 import { PaginatedProducts, type ProductCardComponent } from "./paginated-products"
 import { SkeletonProductGrid } from "./skeleton-product-grid"
@@ -20,7 +20,14 @@ type StoreTemplateProps = {
   /** From the `page` query param. */
   page?: string
   pricingContext?: PricingContextQuery
-  labels?: Partial<StoreLabels>
+  /**
+   * The store's pack for this area, REQUIRED: this is a server component and
+   * cannot read `StorefrontLocaleProvider`, so the page passes
+   * `STORE_LOCALE.store` (`en.store` for an English store). Required since
+   * 2026-09-14 so that forgetting it fails the build instead of shipping
+   * silent English, which is how evoo's search page stayed English.
+   */
+  labels: StoreLabels
   /** Override the default ProductPreview with a store-specific card. */
   renderProduct?: ProductCardComponent
 }
@@ -30,10 +37,9 @@ export function StoreTemplate({
   sortBy,
   page,
   pricingContext,
-  labels,
+  labels: l,
   renderProduct,
 }: StoreTemplateProps) {
-  const l = { ...defaultStoreLabels, ...labels }
   const pageNumber = page ? parseInt(page) : 1
   const sort = sortBy || "created_at"
 

package/src/tracking/chatgpt-pixel.tsx

@@ -2,7 +2,7 @@
 
 import Script from "next/script"
 
-import { CONSENT_COOKIE } from "./consent"
+import { adsConsentSnippet } from "./consent"
 import { jsStringLiteral } from "./inline-script"
 
 /**
@@ -32,9 +32,13 @@ import { jsStringLiteral } from "./inline-script"
  * relies on it. Nothing here relies on behaviour OpenAI has not written
  * down: an unconsented page view is not sent, and not counted on later.
  *
- * The decision is read from the shared `_1c_consent` cookie inside the
- * snippet, before anything can be sent, and live changes arrive through
- * `applyConsent()` in ./consent.ts — there is no cookie watcher.
+ * The decision is the store's default overridden by the visitor's stored
+ * choice (`adsConsentSnippet`), resolved inside the snippet before anything
+ * can be sent: a store that collects consent starts closed, a store with
+ * no consent gate starts open, the cookie winning either way. Live changes
+ * arrive through `applyConsent()` in ./consent.ts — there is no cookie
+ * watcher. `consentRequired` is `tracking.consent_required`, passed by
+ * <StorefrontTags>, and required for the reason <ConsentInit> gives.
  *
  * The page view is ours to fire at all: their pixel sends nothing at init,
  * unlike Meta's and TikTok's base code.
@@ -48,7 +52,14 @@ import { jsStringLiteral } from "./inline-script"
  * Renders nothing when `pixelId` is falsy, so a layout can mount it
  * unconditionally.
  */
-export function ChatGptPixel({ pixelId }: { pixelId?: string }) {
+export function ChatGptPixel({
+  pixelId,
+  consentRequired,
+}: {
+  pixelId?: string
+  /** `tracking.consent_required`: does this store collect consent before it tracks? */
+  consentRequired: boolean
+}) {
   if (!pixelId) return null
 
   const id = jsStringLiteral(pixelId)
@@ -70,11 +81,7 @@ oaiq("consent", false);
 oaiq("init", { pixelId: ${id} });
 
 (function (d) {
-  var ads = false;
-  try {
-    var m = d.cookie.match(/(?:^|; )${CONSENT_COOKIE}=([^;]*)/);
-    if (m) { ads = !!JSON.parse(decodeURIComponent(m[1])).ads; }
-  } catch (e) {}
+  ${adsConsentSnippet(consentRequired, "d")}
   if (ads) {
     oaiq("consent", true);
     oaiq("measure", "page_viewed", { type: "contents" });

package/src/tracking/consent-init.tsx

@@ -1,44 +1,62 @@
-import { CONSENT_INIT_SNIPPET } from "./consent"
-
-/**
- * ConsentInit — the synchronous Consent Mode v2 "default" snippet.
- *
- * Ported from the Cartbase reference implementation
- * `src/components/storefront/consent/consent-init.tsx` (itself from
- * `@1click/ui/src/tracking/consent-init.tsx` v2.3.1); the snippet lives in
- * ./consent.ts (CONSENT_INIT_SNIPPET, character-identical) so its ordering
- * contract is unit-testable.
- *
- * Render it as the FIRST child of <body> (App Router layouts don't
- * expose <head> for inline scripts). A plain inline <script>
- * (deliberately NOT next/script) executes at HTML-parse time — long
- * before the afterInteractive <GA4>/<MetaPixel> loaders, which run
- * post-hydration. Google's consent-mode docs require the default to be
- * set synchronously ahead of the tag; an async default races the
- * loader and the first hit of a returning consented visitor would
- * ship denied.
- *
- * Behavior:
- *   - No stored choice (first visit) → default ALL DENIED. Tags still
- *     load (advanced consent mode): gtag sends cookieless pings, the
- *     Pixel queues client-side. The <ConsentBanner> then collects the
- *     choice and applies the live 'update'.
- *   - Stored choice → default mirrors it, so returning visitors are
- *     correct from the very first hit with no banner and no race.
- *
- * `ads_data_redaction` strips ad-click identifiers (gclid et al.) from
- * the cookieless pings while ad_storage is denied, per Google's docs.
- *
- * The script is static (no props interpolated beyond the shared cookie
- * name) — safe as a server-component inline script with a stable id.
- * CARD TRAP: it must NEVER wait on the /api/store/consent fetch — the
- * per-store config drives the BANNER, not this default.
- */
-export function ConsentInit() {
-  return (
-    <script
-      id="1click-consent-init"
-      dangerouslySetInnerHTML={{ __html: CONSENT_INIT_SNIPPET }}
-    />
-  )
-}
+import { consentInitSnippet } from "./consent"
+
+/**
+ * ConsentInit — the synchronous Consent Mode v2 "default" snippet.
+ *
+ * Ported from the Cartbase reference implementation
+ * `src/components/storefront/consent/consent-init.tsx` (itself from
+ * `@1click/ui/src/tracking/consent-init.tsx` v2.3.1); the snippet lives in
+ * ./consent.ts (`consentInitSnippet`) so its ordering contract is
+ * unit-testable.
+ *
+ * Render it as the FIRST child of <body> (App Router layouts don't
+ * expose <head> for inline scripts). A plain inline <script>
+ * (deliberately NOT next/script) executes at HTML-parse time — long
+ * before the afterInteractive <GA4>/<MetaPixel> loaders, which run
+ * post-hydration. Google's consent-mode docs require the default to be
+ * set synchronously ahead of the tag; an async default races the
+ * loader and the first hit of a returning consented visitor would
+ * ship denied.
+ *
+ * `required` is the store's consent switch, `consent.enabled` from
+ * `GET /api/store/consent`, which the layout already fetches for the
+ * banner. It is REQUIRED on purpose: with it absent there is no safe
+ * default to fall back on. Defaulting to true would keep the pixels of a
+ * store that switched its banner off silent forever (the defect fixed on
+ * 2026-09-14); defaulting to false would fire them on an EU store whose
+ * layout forgot the prop. So the layout states it, and a layout that does
+ * not fails to compile.
+ *
+ * Behavior:
+ *   - `required` and no stored choice (first visit) → default ALL DENIED.
+ *     Tags still load (advanced consent mode): gtag sends cookieless
+ *     pings, the Pixel queues client-side. The <ConsentBanner> then
+ *     collects the choice and applies the live 'update'.
+ *   - not `required` and no stored choice → default ALL GRANTED: the store
+ *     collects no consent, so there is nothing to wait for.
+ *   - Stored choice → default mirrors it, whatever the switch, so
+ *     returning visitors are correct from the very first hit with no
+ *     banner and no race, and a visitor who declined keeps that decision.
+ *
+ * `ads_data_redaction` strips ad-click identifiers (gclid et al.) from
+ * the cookieless pings while ad_storage is denied, per Google's docs.
+ *
+ * The script interpolates one boolean literal and the shared cookie name,
+ * nothing typed by a person — safe as a server-component inline script
+ * with a stable id. CARD TRAP: it must NEVER wait on the
+ * /api/store/consent fetch inside the browser; the layout resolves the
+ * setting on the server and inlines it here.
+ */
+export function ConsentInit({
+  required,
+}: {
+  /** The store's consent switch: `consent.enabled` from `GET /api/store/consent`. */
+  required: boolean
+}) {
+  return (
+    <script
+      id="1click-consent-init"
+      dangerouslySetInnerHTML={{ __html: consentInitSnippet(required) }}
+    />
+  )
+}

package/src/tracking/consent.ts

@@ -169,20 +169,43 @@ export function openConsentSettings(): void {
 }
 
 /**
- * The synchronous Consent Mode v2 "default" snippet — the crown jewel
- * (card trap: NEVER async, NEVER config-dependent-late). Exported as a
- * string so the ordering contract is unit-testable without a DOM:
- * character-identical to the shipped @1click/ui v2.3.1 snippet.
- * `<ConsentInit>` renders it as a plain inline <script>.
+ * THE DEFAULT FLIPS WITH THE STORE'S CONSENT SWITCH; A STORED CHOICE WINS.
+ *
+ * `required` is the store's consent setting (`consent.enabled` on
+ * `GET /api/store/consent`, served again as `tracking.consent_required` on
+ * the integrations block). A store that collects consent starts every
+ * visitor DENIED until they choose, which is what the banner is for. A
+ * store that does not collect consent has nothing to wait for, so its
+ * visitors start GRANTED. Either way a choice the visitor already stored
+ * in the cookie is what counts: someone who declined under a banner keeps
+ * that decision if the banner is later switched off.
+ *
+ * Until 2026-09-14 the default was denied whatever the setting, and the
+ * cookie is written only by the banner or an external CMP, so a store with
+ * the banner off never fired Meta, TikTok, ChatGPT or the Google Ads
+ * destination at all, silently. Alexander's rule: a banner means consent is
+ * collected and the pixels fire on it; no banner means the pixels fire.
+ * This is Consent Mode's own model too: `default` is what applies before a
+ * decision, and Google documents setting it granted where no consent is
+ * needed.
+ *
+ * The synchronous Consent Mode v2 "default" snippet is the crown jewel
+ * (card trap: NEVER async, NEVER waiting on a fetch). It is built as a
+ * string so the ordering contract is unit-testable without a DOM, and the
+ * one value interpolated is a boolean literal, so nothing typed by anyone
+ * can reach the script. `<ConsentInit required>` renders it as a plain
+ * inline <script>.
  */
-export const CONSENT_INIT_SNIPPET = `
+export function consentInitSnippet(required: boolean): string {
+  const fallback = required ? "false" : "true"
+  return `
 (function(){
   var c=null;
   try{
     var m=document.cookie.match(/(?:^|; )${CONSENT_COOKIE}=([^;]*)/);
     if(m){c=JSON.parse(decodeURIComponent(m[1]));}
   }catch(e){}
-  var ads=!!(c&&c.ads), an=!!(c&&c.analytics);
+  var ads=c?!!c.ads:${fallback}, an=c?!!c.analytics:${fallback};
   window.dataLayer=window.dataLayer||[];
   function gtag(){dataLayer.push(arguments);}
   gtag('consent','default',{
@@ -194,6 +217,34 @@ export const CONSENT_INIT_SNIPPET = `
   gtag('set','ads_data_redaction',!ads);
 })();
 `.trim()
+}
+
+/**
+ * The snippet for a store that collects consent, kept under its old name:
+ * the shape every test and every mount before 2026-09-14 knew.
+ */
+export const CONSENT_INIT_SNIPPET = consentInitSnippet(true)
+
+/**
+ * The same rule for the vendors that read the cookie themselves (Meta,
+ * TikTok, ChatGPT: each gates its own SDK before init and cannot use the
+ * gtag default). Returns the statements that leave `var ads` holding the
+ * decision: the store's default, overridden by a stored choice.
+ *
+ * ONE implementation for every pixel-side gate, so a vendor added later
+ * gets the rule by calling this rather than by copying a cookie read.
+ * `cookieSource` is the identifier the vendor's snippet uses for
+ * `document` (TikTok's and OpenAI's loaders alias it as `d`).
+ */
+export function adsConsentSnippet(required: boolean, cookieSource = "document"): string {
+  return `
+var ads=${required ? "false" : "true"};
+try{
+  var m=${cookieSource}.cookie.match(/(?:^|; )${CONSENT_COOKIE}=([^;]*)/);
+  if(m){ads=!!JSON.parse(decodeURIComponent(m[1])).ads;}
+}catch(e){}
+`.trim()
+}
 
 // ── Per-store consent config (GET /api/store/consent) ────────────────
 //

package/src/tracking/index.ts

@@ -79,6 +79,8 @@ export {
   writeConsentCookie,
   shouldRenderBanner,
   pickConsentCopy,
+  consentInitSnippet,
+  adsConsentSnippet,
   CONSENT_COOKIE,
   CONSENT_MAX_AGE_SECONDS,
   CONSENT_OPEN_EVENT,

package/src/tracking/meta-pixel.tsx

@@ -9,7 +9,8 @@ import {
   sha256Hex,
   type KnownVisitor,
 } from "./attribution"
-import { CONSENT_COOKIE } from "./consent"
+import { adsConsentSnippet } from "./consent"
+import { jsStringLiteral } from "./inline-script"
 
 /**
  * MetaPixel — client-side base pixel injector.
@@ -32,17 +33,32 @@ import { CONSENT_COOKIE } from "./consent"
  * single base init covers the initial page; further events are fired
  * explicitly via the helpers in `./fbq.ts`.
  *
- * Consent gate: fbq('consent', …) is pushed from the `_1c_consent`
- * cookie BEFORE fbq('init') — Meta only honors a pre-init revoke, which
- * makes the Pixel queue every event (incl. this PageView) client-side
- * until the <ConsentBanner> grants; a later fbq('consent','grant')
- * flushes the queue. No cookie (first visit) = revoke.
+ * Consent gate: fbq('consent', …) is pushed BEFORE fbq('init') — Meta
+ * only honors a pre-init revoke, which makes the Pixel queue every event
+ * (incl. this PageView) client-side until the <ConsentBanner> grants; a
+ * later fbq('consent','grant') flushes the queue. The decision is the
+ * store's default overridden by the visitor's stored choice
+ * (`adsConsentSnippet`): a store that collects consent starts revoked, a
+ * store with no consent gate starts granted, and a cookie wins either way.
+ *
+ * `consentRequired` is `tracking.consent_required` from the store's
+ * integrations block; <StorefrontTags> passes it. It is required on the
+ * prop for the reason <ConsentInit> gives: neither default is safe.
  */
-export function MetaPixel({ pixelId }: { pixelId?: string }) {
+export function MetaPixel({
+  pixelId,
+  consentRequired,
+}: {
+  pixelId?: string
+  /** `tracking.consent_required`: does this store collect consent before it tracks? */
+  consentRequired: boolean
+}) {
   if (!pixelId) return null
 
+  const id = jsStringLiteral(pixelId)
+
   const initSnippet = `
-window.__1click_fb_pixel_id='${pixelId}';
+window.__1click_fb_pixel_id=${id};
 !function(f,b,e,v,n,t,s)
 {if(f.fbq)return;n=f.fbq=function(){n.callMethod?
 n.callMethod.apply(n,arguments):n.queue.push(arguments)};
@@ -52,14 +68,10 @@ t.src=v;s=b.getElementsByTagName(e)[0];
 s.parentNode.insertBefore(t,s)}(window, document,'script',
 'https://connect.facebook.net/en_US/fbevents.js');
 (function(){
-  var ads=false;
-  try{
-    var m=document.cookie.match(/(?:^|; )${CONSENT_COOKIE}=([^;]*)/);
-    if(m){ads=!!JSON.parse(decodeURIComponent(m[1])).ads;}
-  }catch(e){}
+  ${adsConsentSnippet(consentRequired)}
   fbq('consent', ads?'grant':'revoke');
 })();
-fbq('init', '${pixelId}');
+fbq('init', ${id});
 fbq('track', 'PageView');
 `.trim()
 
@@ -75,7 +87,7 @@ fbq('track', 'PageView');
           height="1"
           width="1"
           style={{ display: "none" }}
-          src={`https://www.facebook.com/tr?id=${pixelId}&ev=PageView&noscript=1`}
+          src={`https://www.facebook.com/tr?id=${encodeURIComponent(pixelId)}&ev=PageView&noscript=1`}
           alt=""
         />
       </noscript>

package/src/tracking/storefront-tags.tsx

@@ -22,10 +22,15 @@ import type { TrackingConfig } from "./types"
  * it at the next deploy.
  *
  * Consent: nothing extra to wire. <ConsentInit> sets the Consent Mode v2
- * defaults synchronously ahead of these, the Meta and TikTok snippets read
- * the shared consent cookie before they are allowed to write cookies, and
- * `applyConsent()` relays a live decision to all three vendors. Mount this
- * AFTER <ConsentInit> and the gate holds.
+ * defaults synchronously ahead of these, the Meta, TikTok and ChatGPT
+ * snippets resolve the same decision before they are allowed to send, and
+ * `applyConsent()` relays a live decision to every vendor. Mount this
+ * AFTER <ConsentInit> and the gate holds. Whether there IS a gate is the
+ * store's own setting, `consent_required` on this same block: a store that
+ * collects consent starts every visitor denied until they choose, a store
+ * with the banner off starts them granted, and a stored choice wins either
+ * way. The block always carries the flag; an absent one is read as
+ * required, the closed side.
  *
  * Google is deliberately ONE tag with two destinations rather than two
  * loaders — see the comment block in ./ga4.tsx. It is also why the Ads
@@ -56,6 +61,8 @@ export async function StorefrontTags({
     }
   }
 
+  const consentRequired = tracking.consent_required ?? true
+
   return (
     <>
       {/* Cartbase's own analytics, always on and never a merchant setting:
@@ -64,9 +71,9 @@ export async function StorefrontTags({
           only appear when the merchant has entered their ids. */}
       <PageViews />
       <LiveHeartbeat />
-      <MetaPixel pixelId={tracking.facebookPixel?.pixelId} />
-      <TikTokPixel pixelId={tracking.tiktok?.pixelId} />
-      <ChatGptPixel pixelId={tracking.chatgptAds?.pixelId} />
+      <MetaPixel pixelId={tracking.facebookPixel?.pixelId} consentRequired={consentRequired} />
+      <TikTokPixel pixelId={tracking.tiktok?.pixelId} consentRequired={consentRequired} />
+      <ChatGptPixel pixelId={tracking.chatgptAds?.pixelId} consentRequired={consentRequired} />
       <GoogleTag
         measurementId={tracking.ga4?.measurementId}
         adsConversionId={tracking.googleAds?.conversionId}

package/src/tracking/tiktok-pixel.tsx

@@ -2,7 +2,7 @@
 
 import Script from "next/script"
 
-import { CONSENT_COOKIE } from "./consent"
+import { adsConsentSnippet } from "./consent"
 import { jsStringLiteral } from "./inline-script"
 
 /**
@@ -33,6 +33,11 @@ import { jsStringLiteral } from "./inline-script"
  *
  * Live decisions arrive through `applyConsent()` in ./consent.ts, which
  * relays to gtag, fbq and ttq together — there is no cookie watcher.
+ * The first decision is the store's default overridden by the visitor's
+ * stored choice (`adsConsentSnippet`): revoked on a store that collects
+ * consent, granted on a store with no consent gate, the cookie winning
+ * either way. `consentRequired` is `tracking.consent_required`, passed by
+ * <StorefrontTags>, and required for the reason <ConsentInit> gives.
  *
  * One dependency outside the code: Cookie Consent Mode must be switched
  * on for this pixel in TikTok Events Manager. With it off, `holdConsent`
@@ -43,7 +48,14 @@ import { jsStringLiteral } from "./inline-script"
  * Renders nothing when `pixelId` is falsy, so a layout can mount it
  * unconditionally.
  */
-export function TikTokPixel({ pixelId }: { pixelId?: string }) {
+export function TikTokPixel({
+  pixelId,
+  consentRequired,
+}: {
+  pixelId?: string
+  /** `tracking.consent_required`: does this store collect consent before it tracks? */
+  consentRequired: boolean
+}) {
   if (!pixelId) return null
 
   const id = jsStringLiteral(pixelId)
@@ -63,11 +75,7 @@ export function TikTokPixel({ pixelId }: { pixelId?: string }) {
   ttq.page();
 
   (function(){
-    var ads=false;
-    try{
-      var m=d.cookie.match(/(?:^|; )${CONSENT_COOKIE}=([^;]*)/);
-      if(m){ads=!!JSON.parse(decodeURIComponent(m[1])).ads;}
-    }catch(e){}
+    ${adsConsentSnippet(consentRequired, "d")}
     if(ads){ttq.grantConsent();}else{ttq.revokeConsent();}
   })();
 }(window, document, 'ttq');

package/src/tracking/types.ts

@@ -48,8 +48,11 @@ export type TrackingConfig = {
    *  token and stays on the platform, read by the order.placed forwarder
    *  (chatgpt-ads-pixel card). */
   chatgptAds?: { pixelId: string }
-  /** True when the store's consent CMP is enabled — client tags must
-   *  mount through the consent gate (`_1c_consent` / Consent Mode v2). */
+  /** Whether this store collects consent before it tracks (the consent
+   *  CMP's `enabled`). True: every tag starts denied until the visitor
+   *  chooses on the banner. False: the store has no consent gate and every
+   *  tag starts granted. A choice stored in `_1c_consent` wins either way.
+   *  Always served; a reader treats an absent value as true. */
   consent_required?: boolean
 }