@consenti/ui 0.1.0

package/dist/index.mjs

@@ -0,0 +1,2221 @@
+import {
+  httpRequest
+} from "./chunk-ARALKXMB.mjs";
+
+// src/styles/consenti-css.ts
+var CONSENTI_CSS = `:root{--consenti-color-bg: #ffffff;--consenti-color-text: #1a2e4a;--consenti-color-primary: #1565c0;--consenti-color-primary-text: #ffffff;--consenti-color-secondary: #f0f4f8;--consenti-color-secondary-text: #1a2e4a;--consenti-color-border: #dbe4ee;--consenti-color-overlay: rgba(26, 52, 96, 0.55);--consenti-font-family: system-ui, -apple-system, sans-serif;--consenti-font-size-base: 14px;--consenti-font-size-heading: 16px;--consenti-font-weight-heading: 600;--consenti-line-height: 1.5;--consenti-spacing-sm: 8px;--consenti-spacing-md: 16px;--consenti-spacing-lg: 24px;--consenti-border-radius: 8px;--consenti-border-radius-btn: 4px;--consenti-shadow: 0 4px 24px rgba(21, 101, 192, 0.14);--consenti-color-accent: #d32f2f;--consenti-color-accent-text: #ffffff;--consenti-toggle-bg-on: #43a047;--consenti-toggle-bg-off: #c8d6e8;--consenti-toggle-knob: #ffffff;--consenti-toggle-width: 44px;--consenti-toggle-height: 24px;--consenti-z-banner: 9999;--consenti-z-overlay: 9998;--consenti-z-modal: 10000}.consenti-root--dark{--consenti-color-bg: #1e2535;--consenti-color-text: #e2e8f0;--consenti-color-primary: #4a9eff;--consenti-color-primary-text: #ffffff;--consenti-color-secondary: #2a3447;--consenti-color-secondary-text: #cbd5e1;--consenti-color-border: #374151;--consenti-color-overlay: rgba(0, 0, 0, 0.65);--consenti-shadow: 0 4px 24px rgba(0, 0, 0, 0.4);--consenti-toggle-bg-off: #4b5563}.consenti-overlay{position:fixed;inset:0;background:var(--consenti-color-overlay);z-index:var(--consenti-z-overlay)}.consenti-btn{display:inline-flex;align-items:center;justify-content:center;padding:var(--consenti-spacing-sm) var(--consenti-spacing-md);border:none;border-radius:var(--consenti-border-radius-btn);font-family:var(--consenti-font-family);font-size:var(--consenti-font-size-base);font-weight:500;line-height:1;cursor:pointer;text-decoration:none;transition:opacity .15s ease}.consenti-btn:focus-visible{outline:2px solid var(--consenti-color-primary);outline-offset:2px}.consenti-btn:hover{opacity:.9}.consenti-btn--primary{background:var(--consenti-color-primary);color:var(--consenti-color-primary-text)}.consenti-btn--secondary{background:var(--consenti-color-secondary);color:var(--consenti-color-secondary-text)}.consenti-btn--text{background:rgba(0,0,0,0);color:var(--consenti-color-primary);padding-left:0;padding-right:0;text-decoration:underline}.consenti-btn--accent{background:var(--consenti-color-accent);color:var(--consenti-color-accent-text)}.consenti-btn--close{background:rgba(0,0,0,0);color:var(--consenti-color-text);font-size:20px;line-height:1;padding:4px 8px;border-radius:50%}.consenti-btn--close:hover{background:var(--consenti-color-secondary);opacity:1}.consenti-banner{position:fixed;left:0;right:0;z-index:var(--consenti-z-banner);background:var(--consenti-color-bg);color:var(--consenti-color-text);font-family:var(--consenti-font-family);font-size:var(--consenti-font-size-base);line-height:var(--consenti-line-height);box-shadow:var(--consenti-shadow);padding:var(--consenti-spacing-lg);display:flex;flex-wrap:wrap;align-items:center;gap:var(--consenti-spacing-md)}.consenti-banner--top{top:0;border-bottom:1px solid var(--consenti-color-border)}@media(prefers-reduced-motion: no-preference){.consenti-banner--top{animation:consenti-slide-down .2s ease-out}}.consenti-banner--bottom{bottom:0;border-top:1px solid var(--consenti-color-border)}@media(prefers-reduced-motion: no-preference){.consenti-banner--bottom{animation:consenti-slide-up .2s ease-out}}.consenti-banner--middle{top:50%;transform:translateY(-50%);left:50%;right:auto;transform:translate(-50%, -50%);width:min(600px,90vw);border-radius:var(--consenti-border-radius)}.consenti-banner--left-bottom{bottom:var(--consenti-spacing-lg);left:var(--consenti-spacing-lg);right:auto;width:min(400px,90vw);border-radius:var(--consenti-border-radius)}.consenti-banner--right-bottom{bottom:var(--consenti-spacing-lg);right:var(--consenti-spacing-lg);left:auto;width:min(400px,90vw);border-radius:var(--consenti-border-radius)}.consenti-banner__text-container{flex:1;min-width:200px}.consenti-banner__heading{font-size:var(--consenti-font-size-heading);font-weight:var(--consenti-font-weight-heading);margin:0 0 var(--consenti-spacing-sm);width:100%}.consenti-banner__text{margin:0}.consenti-banner__links{display:flex;flex-wrap:wrap;gap:var(--consenti-spacing-sm);margin-top:var(--consenti-spacing-sm)}.consenti-banner__link{font-size:.85em;text-decoration:underline;text-underline-offset:2px}.consenti-banner__controls{position:absolute;top:var(--consenti-spacing-sm);right:var(--consenti-spacing-sm);display:flex;align-items:center;gap:4px}.consenti-banner__buttons{display:flex;flex-wrap:wrap;gap:var(--consenti-spacing-sm);align-items:center}.consenti-banner--top .consenti-banner__buttons,.consenti-banner--bottom .consenti-banner__buttons{margin-left:2vw}@keyframes consenti-slide-up{from{transform:translateY(100%)}to{transform:translateY(0)}}@keyframes consenti-slide-down{from{transform:translateY(-100%)}to{transform:translateY(0)}}.consenti-modal{position:fixed;inset:0;z-index:var(--consenti-z-modal);display:flex;font-family:var(--consenti-font-family);font-size:var(--consenti-font-size-base);color:var(--consenti-color-text);line-height:var(--consenti-line-height)}.consenti-modal--passthrough{pointer-events:none}.consenti-modal--passthrough .consenti-modal__container{pointer-events:auto}.consenti-modal--center{align-items:center;justify-content:center}.consenti-modal--left{align-items:stretch;justify-content:flex-start}.consenti-modal--left .consenti-modal__container{border-radius:0 var(--consenti-border-radius) var(--consenti-border-radius) 0;height:100%;max-height:100vh}.consenti-modal--right{align-items:stretch;justify-content:flex-end}.consenti-modal--right .consenti-modal__container{border-radius:0;height:100%;max-height:100vh}.consenti-modal__overlay{position:absolute;inset:0;background:var(--consenti-color-overlay)}.consenti-modal__container{position:relative;z-index:1;background:var(--consenti-color-bg);border-radius:var(--consenti-border-radius);box-shadow:var(--consenti-shadow);width:min(560px,90vw);max-height:85vh;display:flex;flex-direction:column;overflow:hidden}@media(prefers-reduced-motion: no-preference){.consenti-modal__container{animation:consenti-fade-in .15s ease-out}}.consenti-modal__header{display:flex;align-items:center;justify-content:space-between;padding:var(--consenti-spacing-md) var(--consenti-spacing-lg);border-bottom:1px solid var(--consenti-color-border);flex-shrink:0}.consenti-modal__heading{font-size:var(--consenti-font-size-heading);font-weight:var(--consenti-font-weight-heading);margin:0;flex:1}.consenti-modal__header-controls{display:flex;align-items:center;gap:4px;flex-shrink:0}.consenti-modal__close{flex-shrink:0}.consenti-modal__links{display:flex;flex-wrap:wrap;gap:var(--consenti-spacing-sm);padding:var(--consenti-spacing-sm) var(--consenti-spacing-lg)}.consenti-modal__link{font-size:.85em;text-decoration:underline;text-underline-offset:2px}.consenti-modal__subheading{padding:var(--consenti-spacing-sm) var(--consenti-spacing-lg) 0;margin:0;color:#6b7280;font-size:13px}.consenti-modal__text{padding:var(--consenti-spacing-sm) var(--consenti-spacing-lg)}.consenti-modal__body{overflow-y:auto;flex:1;padding:0 var(--consenti-spacing-lg)}.consenti-modal__categories{display:flex;flex-direction:column;gap:var(--consenti-spacing-md);padding:var(--consenti-spacing-md) 0}.consenti-modal__buttons{display:flex;flex-wrap:wrap;gap:var(--consenti-spacing-sm);padding:var(--consenti-spacing-md) var(--consenti-spacing-lg);border-top:1px solid var(--consenti-color-border);flex-shrink:0}.consenti-modal__receipt-option{margin:0 var(--consenti-spacing-lg);padding-top:var(--consenti-spacing-md);border-top:1px solid var(--consenti-color-border);flex-shrink:0}.consenti-modal__receipt-label{display:flex;align-items:center;gap:var(--consenti-spacing-sm);font-size:var(--consenti-font-size-base);cursor:pointer}.consenti-modal__receipt-checkbox{width:16px;height:16px;flex-shrink:0;cursor:pointer}.consenti-modal__receipt-desc{margin:4px 0 0 24px;font-size:12px;color:#6b7280}@keyframes consenti-fade-in{from{opacity:0;transform:scale(0.97)}to{opacity:1;transform:scale(1)}}.consenti-category{padding:var(--consenti-spacing-md) 0;border-bottom:1px solid var(--consenti-color-border)}.consenti-category:last-child{border-bottom:none}.consenti-category--mandatory .consenti-category__toggle{opacity:.6;cursor:default}.consenti-category__header{display:flex;align-items:center;justify-content:space-between;gap:var(--consenti-spacing-md);margin-bottom:var(--consenti-spacing-sm)}.consenti-category__heading{font-size:var(--consenti-font-size-heading);font-weight:var(--consenti-font-weight-heading);margin:0}.consenti-category__text{color:#4b5563;font-size:13px;margin:0}.consenti-category__li-desc{margin:var(--consenti-spacing-sm) 0 0;font-size:12px;color:#6b7280;font-style:italic}.consenti-category__toggle{flex-shrink:0;position:relative;width:var(--consenti-toggle-width);height:var(--consenti-toggle-height);border-radius:calc(var(--consenti-toggle-height)/2);background:var(--consenti-toggle-bg-off);border:none;cursor:pointer;transition:background .2s ease;padding:0}.consenti-category__toggle:focus-visible{outline:2px solid var(--consenti-color-primary);outline-offset:2px}.consenti-category__toggle[aria-checked=true]{background:var(--consenti-toggle-bg-on)}.consenti-category__toggle--mandatory{cursor:default}.consenti-category__toggle-knob{position:absolute;top:2px;left:2px;width:calc(var(--consenti-toggle-height) - 4px);height:calc(var(--consenti-toggle-height) - 4px);border-radius:50%;background:var(--consenti-toggle-knob);transition:transform .2s ease;display:block}[aria-checked=true] .consenti-category__toggle-knob{transform:translateX(calc(var(--consenti-toggle-width) - var(--consenti-toggle-height)))}.consenti-locale-switcher{position:relative;display:inline-flex}.consenti-locale-switcher__btn{font-size:1rem;line-height:1;cursor:pointer}.consenti-locale-switcher__list{position:absolute;top:calc(100% + 4px);right:0;z-index:calc(var(--consenti-z-modal) + 1);background:var(--consenti-color-bg);border:1px solid var(--consenti-color-border);border-radius:var(--consenti-border-radius);box-shadow:var(--consenti-shadow);list-style:none;margin:0;padding:4px 0;min-width:80px}.consenti-locale-switcher__list li{display:block}.consenti-locale-switcher__option{display:block;width:100%;padding:6px 12px;text-align:left;font-size:var(--consenti-font-size-base);color:var(--consenti-color-text);background:none;border:none;cursor:pointer}.consenti-locale-switcher__option:hover{background:var(--consenti-color-secondary)}.consenti-locale-switcher__option--active{font-weight:600;color:var(--consenti-color-primary)}.consenti-locale-switcher--modal .consenti-locale-switcher__list{right:0}`;
+
+// src/utils/ssr.ts
+var isClient = () => typeof window !== "undefined" && typeof document !== "undefined";
+var safeWindow = () => isClient() ? window : null;
+var safeNavigator = () => isClient() && typeof navigator !== "undefined" ? navigator : null;
+
+// src/utils/broadcast.ts
+var ConsentiChannel = class {
+  constructor() {
+    this.channel = null;
+  }
+  /** `true` when `BroadcastChannel` is available in the current environment. */
+  get isSupported() {
+    return isClient() && typeof BroadcastChannel !== "undefined";
+  }
+  /**
+   * Opens the `BroadcastChannel` and registers a message handler.
+   * Silently no-ops if `BroadcastChannel` is unsupported.
+   *
+   * @param onMessage - Callback invoked with each received `ConsentiMessage`.
+   */
+  connect(onMessage) {
+    if (!this.isSupported) return;
+    this.onMessageCallback = onMessage;
+    this.channel = new BroadcastChannel("consenti");
+    this.channel.onmessage = (event) => {
+      if (event.data?.type) {
+        onMessage(event.data);
+      }
+    };
+    this.channel.onmessageerror = () => {
+      console.warn("[Consenti] BroadcastChannel message error \u2014 ignoring");
+    };
+  }
+  /**
+   * Posts a message to all other tabs connected to the `'consenti'` channel.
+   * The sending tab does not receive its own message.
+   *
+   * @param message - The `ConsentiMessage` to broadcast.
+   */
+  send(message) {
+    this.channel?.postMessage(message);
+  }
+  /** Closes the channel and removes the message callback. */
+  disconnect() {
+    this.channel?.close();
+    this.channel = null;
+    this.onMessageCallback = void 0;
+  }
+};
+
+// src/utils/receipt.ts
+function generateReceipt(params) {
+  const receipt = {
+    version: "1.0",
+    issuedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    visitorId: params.visitorId,
+    profileId: params.profileId,
+    profileVersion: params.profileVersion,
+    locale: params.locale,
+    consent: params.consent
+  };
+  if (params.signature) receipt.signature = params.signature;
+  return receipt;
+}
+function downloadReceipt(receipt) {
+  if (typeof window === "undefined" || typeof document === "undefined") return;
+  const json = JSON.stringify(receipt, null, 2);
+  const blob = new Blob([json], { type: "application/json" });
+  const url = URL.createObjectURL(blob);
+  const anchor = document.createElement("a");
+  anchor.href = url;
+  anchor.download = `consenti-receipt-${receipt.issuedAt.slice(0, 10)}.json`;
+  anchor.style.display = "none";
+  document.body.appendChild(anchor);
+  anchor.click();
+  document.body.removeChild(anchor);
+  setTimeout(() => URL.revokeObjectURL(url), 1e3);
+}
+
+// src/utils/cookie.ts
+function getCookie(name) {
+  if (!isClient()) return null;
+  const match = document.cookie.match(new RegExp(`(?:^|;\\s*)${escapeRegExp(name)}=([^;]*)`));
+  return match ? decodeURIComponent(match[1] ?? "") : null;
+}
+function setCookie(name, value, opts = {}) {
+  if (!isClient()) return;
+  const secure = opts.secure ?? (typeof window !== "undefined" && typeof window.location !== "undefined" && window.location.protocol === "https:");
+  const parts = [
+    `${encodeURIComponent(name)}=${encodeURIComponent(value)}`,
+    `Path=${opts.path ?? "/"}`,
+    `SameSite=${opts.sameSite ?? "Lax"}`,
+    opts.maxAge != null ? `Max-Age=${opts.maxAge}` : "",
+    secure ? "Secure" : "",
+    opts.domain ? `Domain=${opts.domain}` : ""
+  ];
+  document.cookie = parts.filter(Boolean).join("; ");
+}
+function deleteCookie(name, opts = {}) {
+  setCookie(name, "", { ...opts, maxAge: 0 });
+}
+function escapeRegExp(str) {
+  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+// src/utils/storage.ts
+var ConsentStorage = class {
+  /**
+   * @param mode - `'cookie'` (default) or `'localStorage'`. Falls back to `'cookie'` if
+   *               `localStorage` is requested but unavailable in the current environment.
+   */
+  constructor(mode) {
+    this.mode = mode;
+    if (mode === "localStorage" && isClient() && typeof localStorage === "undefined") {
+      console.warn("[Consenti] localStorage is not available, falling back to cookie storage");
+      this.mode = "cookie";
+    }
+  }
+  /**
+   * Reads a value from storage.
+   *
+   * @param key - Cookie name or localStorage key.
+   * @returns The stored string value, or `null` if absent or SSR context.
+   */
+  read(key) {
+    if (!isClient()) return null;
+    if (this.mode === "localStorage") {
+      return localStorage.getItem(key);
+    }
+    return getCookie(key);
+  }
+  /**
+   * Writes a value to storage.
+   *
+   * @param key   - Cookie name or localStorage key.
+   * @param value - String value to persist.
+   * @param opts  - Cookie attributes (ignored in localStorage mode).
+   */
+  write(key, value, opts = {}) {
+    if (!isClient()) return;
+    if (this.mode === "localStorage") {
+      localStorage.setItem(key, value);
+    } else {
+      setCookie(key, value, opts);
+    }
+  }
+  /**
+   * Removes a value from storage.
+   *
+   * @param key  - Cookie name or localStorage key.
+   * @param opts - Cookie `path` / `domain` attributes (must match the original write call).
+   */
+  remove(key, opts = {}) {
+    if (!isClient()) return;
+    if (this.mode === "localStorage") {
+      localStorage.removeItem(key);
+    } else {
+      deleteCookie(key, opts);
+    }
+  }
+};
+
+// src/core/consent-store.ts
+var COOKIE_NAME_PREFIX = "consenti";
+function buildConsentCookieName(userId, profileId) {
+  return `${COOKIE_NAME_PREFIX}_${userId}_${profileId}`;
+}
+function buildCookieValue(consent) {
+  const epochSeconds = Math.floor(Date.now() / 1e3);
+  const pairs = Object.entries(consent).map(([id, status]) => `${id}:${status}`).join("|");
+  return `t:${epochSeconds}::${pairs}`;
+}
+function parseConsentCookie(value) {
+  const parts = value.split("::");
+  if (parts.length < 2) return null;
+  const tsPart = parts[0] ?? "";
+  let timestamp;
+  if (tsPart.startsWith("t:")) {
+    const epochStr = tsPart.slice(2);
+    const epoch = parseInt(epochStr, 10);
+    if (!epochStr || isNaN(epoch)) return null;
+    timestamp = new Date(epoch * 1e3).toISOString();
+  } else if (tsPart.startsWith("ConsentTimestamp:")) {
+    timestamp = tsPart.replace("ConsentTimestamp:", "");
+    if (!timestamp) return null;
+  } else {
+    return null;
+  }
+  const consentPart = parts[1] ?? "";
+  const sigPart = parts[2];
+  const consent = {};
+  for (const pair of consentPart.split("|")) {
+    const colonIdx = pair.indexOf(":");
+    if (colonIdx === -1) return null;
+    const id = pair.slice(0, colonIdx);
+    const status = pair.slice(colonIdx + 1);
+    if (!id || status !== "granted" && status !== "denied" && status !== "objected") {
+      return null;
+    }
+    consent[id] = status;
+  }
+  const result = { timestamp, consent };
+  if (sigPart?.startsWith("sig:")) {
+    result.signature = sigPart.slice(4);
+  }
+  return result;
+}
+var ConsentStore = class _ConsentStore {
+  /**
+   * @param userId        - Visitor UUID (from `consenti_uid` cookie).
+   * @param profileId     - Numeric profile ID.
+   * @param storageMode   - `'cookie'` (default, cross-subdomain) or `'localStorage'` (origin-scoped).
+   * @param cookieDomains - Comma-separated domain list. First entry used as `Domain` attribute.
+   */
+  constructor(userId, profileId, storageMode, cookieDomains) {
+    this.userId = userId;
+    this.profileId = profileId;
+    this.cookieDomains = cookieDomains;
+    this.cachedConsent = null;
+    this.cachedTimestamp = null;
+    this.storage = new ConsentStorage(storageMode);
+  }
+  /** The full cookie / localStorage key for this visitor + profile combination. */
+  get cookieName() {
+    return buildConsentCookieName(this.userId, this.profileId);
+  }
+  /**
+   * Reads and parses the stored consent record.
+   * Updates the in-memory cache on success.
+   *
+   * @returns The parsed consent or `null` if absent / malformed.
+   */
+  read() {
+    const raw = this.storage.read(this.cookieName);
+    if (!raw) return null;
+    const parsed = parseConsentCookie(raw);
+    if (parsed) {
+      this.cachedConsent = parsed.consent;
+      this.cachedTimestamp = parsed.timestamp;
+    }
+    return parsed;
+  }
+  /**
+   * Reads, parses, and cryptographically verifies the stored consent record.
+   *
+   * If the cookie has a `::sig:{hmac}` segment, the signature is verified against
+   * the raw value using HMAC-SHA256. A mismatch means the cookie was tampered with —
+   * the cookie is deleted and `null` is returned so the widget re-prompts for consent.
+   *
+   * If the cookie has no signature segment, it is treated as valid (backwards compatible
+   * with cookies written before `signCookies` was enabled).
+   *
+   * @param signingKey - The HMAC key (from profile API response or `core.cookieSigningKey`).
+   * @returns The parsed consent, or `null` if absent / malformed / signature invalid.
+   */
+  async readAndVerify(signingKey) {
+    const raw = this.storage.read(this.cookieName);
+    if (!raw) return null;
+    const parts = raw.split("::");
+    if (parts.length < 2) return null;
+    const parsed = parseConsentCookie(raw);
+    if (!parsed) return null;
+    const hasSig = parts.length === 3 && (parts[2] ?? "").startsWith("sig:");
+    if (hasSig) {
+      const { verifyValue } = await import("./hmac-N6H7F2K2.mjs");
+      const valueToVerify = (parts[0] ?? "") + "::" + (parts[1] ?? "");
+      const sig = (parts[2] ?? "").slice(4);
+      const valid = await verifyValue(valueToVerify, sig, signingKey);
+      if (!valid) {
+        console.warn("[Consenti] Cookie signature mismatch \u2014 consent cleared and banner will re-appear");
+        this.delete();
+        return null;
+      }
+    }
+    this.cachedConsent = parsed.consent;
+    this.cachedTimestamp = parsed.timestamp;
+    return parsed;
+  }
+  /**
+   * Writes a consent record to storage.
+   *
+   * @param consent   - The consent map to persist.
+   * @param signature - Optional pre-computed HMAC hex string. Use `writeAndSign()` instead
+   *                    if you need signing — it guarantees the signature covers the exact
+   *                    value that gets written (timestamps match).
+   */
+  write(consent, signature) {
+    let value = buildCookieValue(consent);
+    if (signature) {
+      value = `${value}::sig:${signature}`;
+    }
+    const opts = this.buildCookieOpts();
+    this.storage.write(this.cookieName, value, opts);
+    this.cachedConsent = consent;
+    this.cachedTimestamp = (/* @__PURE__ */ new Date()).toISOString();
+  }
+  /**
+   * Builds the cookie value, signs it with HMAC-SHA256 in a single atomic step,
+   * and writes the signed value to storage.
+   *
+   * Using this instead of `write(consent, signature)` ensures the signature
+   * covers exactly the value that is written — there is no timestamp drift
+   * between building, signing, and writing.
+   *
+   * @param consent    - The consent map to persist.
+   * @param signingKey - The HMAC key string.
+   * @returns The hex-encoded signature, stored in `this.lastSignature` by the caller.
+   */
+  async writeAndSign(consent, signingKey) {
+    const { signValue } = await import("./hmac-N6H7F2K2.mjs");
+    const rawValue = buildCookieValue(consent);
+    const sig = await signValue(rawValue, signingKey);
+    const finalValue = `${rawValue}::sig:${sig}`;
+    const opts = this.buildCookieOpts();
+    this.storage.write(this.cookieName, finalValue, opts);
+    this.cachedConsent = consent;
+    this.cachedTimestamp = (/* @__PURE__ */ new Date()).toISOString();
+    return sig;
+  }
+  /** Removes the consent record from storage and clears the in-memory cache. */
+  delete() {
+    const opts = this.buildCookieOpts();
+    this.storage.remove(this.cookieName, opts);
+    this.cachedConsent = null;
+    this.cachedTimestamp = null;
+  }
+  /** Returns `true` if a valid consent record exists (uses cache when available). */
+  hasConsent() {
+    if (this.cachedConsent) return true;
+    return this.read() !== null;
+  }
+  /** Returns the stored consent map, or `null` if no consent has been given. */
+  getConsent() {
+    if (this.cachedConsent) return this.cachedConsent;
+    return this.read()?.consent ?? null;
+  }
+  /** Returns the `Date` of the last consent submission, or `false` if no consent exists. */
+  getConsentDate() {
+    if (this.cachedTimestamp) return new Date(this.cachedTimestamp);
+    const parsed = this.read();
+    if (!parsed) return false;
+    return new Date(parsed.timestamp);
+  }
+  /**
+   * Updates the in-memory cache without writing to storage.
+   * Used by the cross-tab BroadcastChannel handler to keep other tabs in sync.
+   */
+  setInMemory(consent) {
+    this.cachedConsent = consent;
+    this.cachedTimestamp = (/* @__PURE__ */ new Date()).toISOString();
+  }
+  /** Clears the in-memory cache. Used when consent is deleted from another tab. */
+  clearInMemory() {
+    this.cachedConsent = null;
+    this.cachedTimestamp = null;
+  }
+  /**
+   * Derives the visitor UUID from an existing consent cookie, or generates a new one
+   * in memory.
+   *
+   * No separate identifier cookie is written before consent. Storing a tracking
+   * identifier before the user has given consent violates TTDSG §25 (Germany) and
+   * equivalent ePrivacy laws in the EU. The UUID is embedded in the consent cookie
+   * name and only persisted when consent is first saved (via `write()` / `writeAndSign()`).
+   *
+   * @param profileId   - The active profile ID, used to locate an existing consent cookie.
+   * @param storageMode - The configured storage mode (`'cookie'` or `'localStorage'`).
+   */
+  static getOrCreateUserId(profileId, storageMode) {
+    if (typeof document === "undefined") return crypto.randomUUID();
+    const prefix = `${COOKIE_NAME_PREFIX}_`;
+    const suffix = `_${profileId}`;
+    const all = storageMode === "localStorage" ? _ConsentStore._localStorageKeys() : _ConsentStore._cookieNames();
+    for (const name of all) {
+      if (name.startsWith(prefix) && name.endsWith(suffix)) {
+        const inner = name.slice(prefix.length, name.length - suffix.length);
+        if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(inner)) {
+          return inner;
+        }
+      }
+    }
+    return crypto.randomUUID();
+  }
+  /** Returns all document.cookie names. */
+  static _cookieNames() {
+    return document.cookie.split(";").map((c) => c.split("=")[0]?.trim() ?? "");
+  }
+  /** Returns all localStorage keys (empty array when unavailable). */
+  static _localStorageKeys() {
+    if (typeof localStorage === "undefined") return [];
+    return Object.keys(localStorage);
+  }
+  buildCookieOpts() {
+    const opts = {
+      path: "/",
+      sameSite: "Lax",
+      maxAge: 365 * 24 * 60 * 60
+    };
+    if (this.cookieDomains) {
+      const domain = this.cookieDomains.split(",")[0]?.trim();
+      if (domain) opts.domain = domain;
+    }
+    return opts;
+  }
+};
+
+// src/core/event-bus.ts
+var EventBus = class {
+  /**
+   * @param profileId - Profile ID included in all GTM pushes.
+   * @param gtmConfig - Optional GTM integration settings.
+   */
+  constructor(profileId, gtmConfig) {
+    this.profileId = profileId;
+    this.gtmConfig = gtmConfig;
+  }
+  /**
+   * Dispatches a `consenti:*` custom event on `window` and, if GTM is configured,
+   * pushes the event to `window.dataLayer`.
+   *
+   * Silently no-ops in SSR contexts.
+   *
+   * @param name   - The event name.
+   * @param detail - Event payload attached to `event.detail` and included in the GTM push.
+   */
+  dispatch(name, detail = {}) {
+    if (!isClient()) return;
+    const event = new CustomEvent(name, { detail, bubbles: true });
+    window.dispatchEvent(event);
+    this.pushToGTM(name, detail);
+  }
+  pushToGTM(name, detail) {
+    const gtm = this.gtmConfig;
+    if (!gtm) return;
+    const win = safeWindow();
+    if (!win) return;
+    const layerName = gtm.dataLayer ?? "dataLayer";
+    const layer = win[layerName];
+    if (!Array.isArray(layer)) return;
+    const shouldPush = !gtm.events || gtm.events.length === 0 || gtm.events.includes(name);
+    if (!shouldPush) return;
+    layer.push({
+      event: name,
+      consenti: {
+        profileId: this.profileId,
+        consent: detail.consent,
+        consentId: detail.consentId,
+        consentAction: detail.consentAction
+      }
+    });
+    if (name === "consenti:consentSubmitted" && this.hasGtag(win)) {
+      if (gtm.urlPassthrough) {
+        layer.push({ url_passthrough: true });
+      }
+      if (gtm.adsDataRedaction) {
+        const adConsentDenied = detail.consent?.["ad_storage"] !== "granted";
+        layer.push({ ads_data_redaction: adConsentDenied });
+      }
+    }
+  }
+  /**
+   * Returns `true` when gtag.js or Google Tag Manager is detected on the page.
+   * Used to gate GCM v2 cookieless-ping pushes so they are not emitted when
+   * Google services are absent.
+   */
+  hasGtag(win) {
+    return typeof win["gtag"] === "function" || typeof win["google_tag_manager"] !== "undefined";
+  }
+};
+
+// src/utils/locale.ts
+function resolveLocale(translations, requested, defaultLocale) {
+  const base = translations[defaultLocale];
+  if (!base) {
+    throw new Error(`[Consenti] No translations found for defaultLocale "${defaultLocale}"`);
+  }
+  if (translations[requested]) {
+    return deepMerge(base, translations[requested]);
+  }
+  const lang = requested.split("-")[0] ?? "";
+  if (lang !== requested && translations[lang]) {
+    return deepMerge(base, translations[lang]);
+  }
+  return base;
+}
+function deepMerge(base, override) {
+  const result = { ...base };
+  for (const key in override) {
+    const overrideVal = override[key];
+    if (overrideVal === void 0 || overrideVal === null) continue;
+    if (typeof overrideVal === "object" && !Array.isArray(overrideVal) && typeof result[key] === "object" && result[key] !== null && !Array.isArray(result[key])) {
+      result[key] = deepMerge(result[key], overrideVal);
+    } else {
+      result[key] = overrideVal;
+    }
+  }
+  return result;
+}
+
+// src/core/profile-resolver.ts
+var profileRegistry = /* @__PURE__ */ new Map();
+function registerProfile(id, config) {
+  profileRegistry.set(id, config);
+}
+var DEFAULT_PROFILE = {
+  id: 0,
+  version: 1,
+  defaultLocale: "en",
+  cookies: [
+    { id: "functionality_storage", mandatory: true },
+    {
+      id: "analytics_storage",
+      listenGpc: true,
+      expiry: 365
+    },
+    {
+      id: "ad_storage",
+      listenGpc: true,
+      expiry: 365
+    },
+    {
+      id: "ad_user_data",
+      listenGpc: true,
+      expiry: 365
+    },
+    {
+      id: "ad_personalization",
+      listenGpc: true,
+      expiry: 365
+    }
+  ],
+  mainBanner: {
+    position: "bottom",
+    heading: "We value your privacy",
+    htmlText: "We use cookies to enhance your browsing experience, serve personalised ads or content, and analyse our traffic. By clicking <strong>Accept All</strong> you consent to our use of cookies. You may change your preferences at any time.",
+    buttons: [
+      { text: "Accept All", cookies: "*", style: "primary", action: "custom" },
+      { text: "Reject All", cookies: "!", style: "primary", action: "custom" },
+      { text: "Manage Preferences", style: "secondary", action: "manage" }
+    ]
+  },
+  preferenceModal: {
+    heading: "Cookie Preferences",
+    subheading: "Choose which cookies you allow us to use.",
+    htmlText: "We use different types of cookies to optimise your experience. You can choose to enable or disable each category below. Necessary cookies cannot be disabled as they are required for core site functionality.",
+    showClose: true,
+    overlayOpacity: 50,
+    categories: [
+      {
+        id: "cat-necessary",
+        heading: "Strictly Necessary",
+        htmlText: "These cookies are essential for the website to function correctly. They include authentication, security, and accessibility features. They cannot be disabled.",
+        mandatory: true,
+        cookies: ["functionality_storage"]
+      },
+      {
+        id: "cat-analytics",
+        heading: "Analytics",
+        htmlText: "These cookies help us understand how visitors interact with our website by collecting and reporting information anonymously. This allows us to improve the site over time. (e.g. Google Analytics)",
+        cookies: ["analytics_storage"]
+      },
+      {
+        id: "cat-advertising",
+        heading: "Advertising",
+        htmlText: "These cookies are used to deliver advertisements more relevant to you and your interests. They are also used to limit the number of times you see an ad and to help measure the effectiveness of advertising campaigns. (e.g. Google Ads, Meta Pixel)",
+        cookies: ["ad_storage", "ad_user_data", "ad_personalization"]
+      }
+    ],
+    buttons: [
+      { text: "Accept All", cookies: "*", style: "primary", action: "custom" },
+      { text: "Save Preferences", style: "primary", action: "submit" },
+      { text: "Reject All", cookies: "!", style: "primary", action: "custom" }
+    ]
+  }
+};
+async function resolveProfile(config) {
+  const locale = config.core.locale ?? "en";
+  const profileId = config.core.profileId ?? 0;
+  if (config.api?.enabled) {
+    try {
+      const base = config.api.baseUrl ?? (typeof window !== "undefined" ? window.location.origin : "");
+      const url = `${base}/consenti/api/v1/profiles/${profileId}/${encodeURIComponent(locale)}`;
+      const apiProfile = await httpRequest(url, {}, config.api.authToken);
+      return {
+        id: profileId,
+        version: apiProfile.version,
+        defaultLocale: apiProfile.defaultLocale,
+        locales: apiProfile.locales,
+        cookies: apiProfile.cookies,
+        mainBanner: apiProfile.mainBanner,
+        preferenceModal: apiProfile.preferenceModal,
+        ...apiProfile.gpcBanner != null ? { gpcBanner: apiProfile.gpcBanner } : {}
+      };
+    } catch {
+      console.warn("[Consenti] API profile fetch failed, falling back to local profile");
+    }
+  }
+  if (profileId > 0) {
+    const local = profileRegistry.get(profileId);
+    if (local) {
+      const resolved = resolveLocale(local.translations ?? {}, locale, local.defaultLocale);
+      return {
+        id: profileId,
+        version: 1,
+        defaultLocale: local.defaultLocale,
+        locales: Object.keys(local.translations ?? {}),
+        cookies: local.cookies ?? [],
+        mainBanner: resolved.mainBanner,
+        ...resolved.gpcBanner ? { gpcBanner: resolved.gpcBanner } : {},
+        preferenceModal: resolved.preferenceModal,
+        ...local.darkMode !== void 0 ? { darkMode: local.darkMode } : {}
+      };
+    }
+    throw new Error(
+      `[Consenti] Profile ${profileId} not found. Register it with ConsentiProfile or enable the API.`
+    );
+  }
+  return DEFAULT_PROFILE;
+}
+
+// src/core/gpc.ts
+function detectGPC() {
+  const nav = safeNavigator();
+  if (!nav) return false;
+  return "globalPrivacyControl" in nav && nav.globalPrivacyControl === true;
+}
+function applyGPCToConsent(cookies, currentConsent, mode) {
+  if (!mode || !detectGPC()) return { ...currentConsent };
+  const result = { ...currentConsent };
+  for (const cookie of cookies) {
+    if (cookie.mandatory) continue;
+    if (cookie.listenGpc) {
+      result[cookie.id] = cookie.type === "legitimate_interest" ? "objected" : "denied";
+    }
+  }
+  for (const cookie of cookies) {
+    if (cookie.mandatory) result[cookie.id] = "granted";
+  }
+  return result;
+}
+
+// src/ui/buttons.ts
+function buildButton(btn, handlers) {
+  const el = document.createElement("button");
+  el.type = "button";
+  el.className = `consenti-btn consenti-btn--${btn.style}`;
+  el.textContent = btn.text;
+  el.addEventListener("click", () => {
+    switch (btn.action) {
+      case "custom": {
+        const cookies = btn.cookies;
+        if (cookies === "*") {
+          handlers.onGrantAll();
+        } else if (cookies === "!") {
+          handlers.onDenyAll();
+        } else if (Array.isArray(cookies) && cookies.length > 0) {
+          handlers.onGrantSpecific(cookies);
+        }
+        break;
+      }
+      case "submit":
+        handlers.onSubmit();
+        break;
+      case "manage":
+        handlers.onManage();
+        break;
+      case "close":
+        handlers.onClose();
+        break;
+    }
+  });
+  return el;
+}
+
+// src/ui/overlay.ts
+function createOverlay(opacity, onClick) {
+  const el = document.createElement("div");
+  el.className = "consenti-overlay";
+  el.style.opacity = String(opacity / 100);
+  el.setAttribute("aria-hidden", "true");
+  if (onClick) {
+    el.addEventListener("click", onClick);
+  }
+  return el;
+}
+
+// src/ui/banner.ts
+var Banner = class {
+  constructor() {
+    this.el = null;
+    this.overlayEl = null;
+  }
+  /**
+   * Constructs the banner DOM from the given config and returns the root element.
+   * The element is not yet inserted into the document — the caller appends it to
+   * the mount root via `Renderer.mount()`.
+   *
+   * @param config           - Banner layout and content config from the resolved profile.
+   * @param handlers         - Click handlers wired to each button.
+   * @param privacyPolicyUrl - Optional URL appended as a "Privacy Policy" link after the body text.
+   * @param locales          - All locale codes available on the profile (for the locale switcher).
+   * @param activeLocale     - The currently active locale code.
+   * @param onLocaleSwitch   - Callback invoked when the user selects a different locale.
+   * @returns The constructed banner `<div>` element.
+   */
+  build(config, handlers, privacyPolicyUrl, locales, activeLocale, onLocaleSwitch) {
+    const banner = document.createElement("div");
+    banner.id = "consenti-banner";
+    banner.className = `consenti-banner consenti-banner--${config.position}`;
+    banner.setAttribute("role", "region");
+    banner.setAttribute("aria-label", "Cookie consent");
+    banner.setAttribute("aria-live", "polite");
+    const textContainer = document.createElement("div");
+    textContainer.className = `consenti-banner__text-container`;
+    const linksContainer = document.createElement("div");
+    linksContainer.className = "consenti-banner__links";
+    if (config.heading) {
+      const headingTag = config.headingTag ?? "h2";
+      const heading = document.createElement(headingTag);
+      heading.id = "consenti-banner-heading";
+      heading.className = "consenti-banner__heading";
+      heading.textContent = config.heading;
+      textContainer.appendChild(heading);
+    }
+    const text = document.createElement("div");
+    text.className = "consenti-banner__text";
+    text.innerHTML = config.htmlText;
+    if (privacyPolicyUrl) {
+      const link = document.createElement("a");
+      link.href = privacyPolicyUrl;
+      link.className = "consenti-banner__link consenti-banner__link--privacy consenti-btn consenti-btn--text";
+      link.textContent = "Privacy Policy";
+      link.setAttribute("target", "_blank");
+      link.setAttribute("rel", "noopener noreferrer");
+      linksContainer.appendChild(link);
+    }
+    textContainer.appendChild(text);
+    const linkButtons = config.buttons.filter((b) => b.action === "link");
+    if (linkButtons.length > 0) {
+      for (const btn of linkButtons) {
+        if (!btn.url) continue;
+        const anchor = document.createElement("a");
+        anchor.href = btn.url;
+        anchor.className = `consenti-banner__link consenti-btn consenti-btn--${btn.style ?? "text"}`;
+        anchor.textContent = btn.text;
+        anchor.setAttribute("target", "_blank");
+        anchor.setAttribute("rel", "noopener noreferrer");
+        linksContainer.appendChild(anchor);
+      }
+    }
+    if (linkButtons.length > 0 || privacyPolicyUrl) {
+      textContainer.appendChild(linksContainer);
+    }
+    banner.appendChild(textContainer);
+    const actionButtons = config.buttons.filter((b) => b.action !== "link");
+    if (actionButtons.length > 0) {
+      const btns = document.createElement("div");
+      btns.className = "consenti-banner__buttons";
+      for (const btn of actionButtons) {
+        btns.appendChild(buildButton(btn, handlers));
+      }
+      banner.appendChild(btns);
+    }
+    const hasClose = config.showClose;
+    const hasLocaleSwitcher = config.showLocaleSwitcher && locales && locales.length > 1;
+    if (hasClose || hasLocaleSwitcher) {
+      const controls = document.createElement("div");
+      controls.className = "consenti-banner__controls";
+      if (hasLocaleSwitcher && locales && onLocaleSwitch) {
+        controls.appendChild(buildLocaleSwitcher(locales, activeLocale, onLocaleSwitch));
+      }
+      if (hasClose) {
+        const close = document.createElement("button");
+        close.type = "button";
+        close.className = "consenti-banner__close consenti-btn consenti-btn--close";
+        close.setAttribute("aria-label", "Close cookie banner");
+        close.textContent = "\xD7";
+        close.addEventListener("click", handlers.onClose);
+        controls.appendChild(close);
+      }
+      banner.appendChild(controls);
+    }
+    if (config.overlayOpacity && config.overlayOpacity > 0) {
+      this.overlayEl = createOverlay(config.overlayOpacity);
+    }
+    this.el = banner;
+    return banner;
+  }
+  /** Returns the overlay element (if `overlayOpacity > 0`), or `null`. */
+  getOverlay() {
+    return this.overlayEl;
+  }
+  /** Makes the banner and its overlay visible after a `hide()` call. */
+  show() {
+    if (this.el) this.el.style.display = "";
+    if (this.overlayEl) this.overlayEl.style.display = "";
+  }
+  /** Hides the banner and its overlay without removing them from the DOM. */
+  hide() {
+    if (this.el) this.el.style.display = "none";
+    if (this.overlayEl) this.overlayEl.style.display = "none";
+  }
+  /** Removes the banner and overlay from the DOM entirely. */
+  remove() {
+    this.el?.remove();
+    this.overlayEl?.remove();
+    this.el = null;
+    this.overlayEl = null;
+  }
+};
+function buildLocaleSwitcher(locales, activeLocale, onSwitch) {
+  const wrapper = document.createElement("div");
+  wrapper.className = "consenti-locale-switcher";
+  const btn = document.createElement("button");
+  btn.type = "button";
+  btn.className = "consenti-locale-switcher__btn consenti-btn consenti-btn--close";
+  btn.setAttribute("aria-label", "Switch language");
+  btn.setAttribute("aria-haspopup", "listbox");
+  btn.textContent = "\u{1F310}";
+  const list = document.createElement("ul");
+  list.className = "consenti-locale-switcher__list";
+  list.setAttribute("role", "listbox");
+  list.setAttribute("aria-label", "Select language");
+  list.hidden = true;
+  for (const locale of locales) {
+    const item = document.createElement("li");
+    item.setAttribute("role", "option");
+    item.setAttribute("aria-selected", String(locale === activeLocale));
+    const localeBtn = document.createElement("button");
+    localeBtn.type = "button";
+    localeBtn.className = `consenti-locale-switcher__option${locale === activeLocale ? " consenti-locale-switcher__option--active" : ""}`;
+    localeBtn.textContent = locale;
+    localeBtn.addEventListener("click", (e) => {
+      e.stopPropagation();
+      list.hidden = true;
+      if (locale !== activeLocale) onSwitch(locale);
+    });
+    item.appendChild(localeBtn);
+    list.appendChild(item);
+  }
+  btn.addEventListener("click", (e) => {
+    e.stopPropagation();
+    list.hidden = !list.hidden;
+  });
+  document.addEventListener("click", () => {
+    list.hidden = true;
+  }, { capture: true, once: false });
+  wrapper.appendChild(btn);
+  wrapper.appendChild(list);
+  return wrapper;
+}
+
+// src/ui/focus-trap.ts
+var FOCUSABLE_SELECTORS = [
+  "a[href]",
+  "button:not([disabled])",
+  "input:not([disabled])",
+  "select:not([disabled])",
+  "textarea:not([disabled])",
+  '[tabindex]:not([tabindex="-1"])',
+  '[contenteditable="true"]'
+].join(", ");
+function trapFocus(container) {
+  const getFocusable = () => Array.from(container.querySelectorAll(FOCUSABLE_SELECTORS)).filter(
+    (el) => !el.closest('[aria-hidden="true"]')
+  );
+  const handleKeydown = (e) => {
+    if (e.key !== "Tab") return;
+    const els = getFocusable();
+    if (els.length === 0) return;
+    const first = els[0];
+    const last = els[els.length - 1];
+    if (e.shiftKey) {
+      if (document.activeElement === first || document.activeElement === container) {
+        e.preventDefault();
+        last.focus();
+      }
+    } else {
+      if (document.activeElement === last) {
+        e.preventDefault();
+        first.focus();
+      }
+    }
+  };
+  const handleEscape = (e) => {
+    if (e.key === "Escape") {
+      container.dispatchEvent(new CustomEvent("consenti:closeRequest", { bubbles: true }));
+    }
+  };
+  document.addEventListener("keydown", handleKeydown);
+  document.addEventListener("keydown", handleEscape);
+  getFocusable()[0]?.focus();
+  return () => {
+    document.removeEventListener("keydown", handleKeydown);
+    document.removeEventListener("keydown", handleEscape);
+  };
+}
+
+// src/ui/modal.ts
+var Modal = class {
+  constructor() {
+    this.el = null;
+    this.triggerEl = null;
+    this.trapCleanup = null;
+    /** Map of category ID → toggle button element, used to read state on submit. */
+    this.toggleMap = /* @__PURE__ */ new Map();
+    this.receiptCheckbox = null;
+    /** Live toggle state — updated on each click so `getToggleConsent()` reads the latest. */
+    this.toggleState = /* @__PURE__ */ new Map();
+    /** When `true`, the modal wrapper is passthrough (overlayOpacity === 0). */
+    this.passthrough = false;
+  }
+  /**
+   * Constructs the modal DOM from the given config.
+   * The modal is not inserted into the document until `open()` is called.
+   *
+   * @param config         - Modal layout and content config from the resolved profile.
+   * @param initialConsent - Current stored consent, used to pre-set toggle states.
+   * @param handlers       - Click handlers wired to each button.
+   * @param allowReceipt   - When `true`, renders the consent receipt download checkbox.
+   * @param dpdpaConfig    - DPDPA grievance notice config.
+   * @param locales        - All available locale codes (for locale switcher).
+   * @param activeLocale   - The currently active locale code.
+   * @param onLocaleSwitch - Callback invoked when the user selects a different locale.
+   */
+  build(config, initialConsent, handlers, allowReceipt, dpdpaConfig, locales, activeLocale, onLocaleSwitch) {
+    const position = config.position ?? "center";
+    const wrapper = document.createElement("div");
+    wrapper.id = "consenti-modal";
+    wrapper.className = `consenti-modal consenti-modal--${position}`;
+    wrapper.setAttribute("role", "dialog");
+    wrapper.setAttribute("aria-modal", "true");
+    const overlayOpacity = config.overlayOpacity ?? 50;
+    this.passthrough = overlayOpacity === 0;
+    if (overlayOpacity > 0) {
+      const overlayClickHandler = config.persistent ? void 0 : () => handlers.onClose();
+      const overlay = createOverlay(overlayOpacity, overlayClickHandler);
+      overlay.className = "consenti-modal__overlay";
+      wrapper.appendChild(overlay);
+    } else {
+      wrapper.classList.add("consenti-modal--passthrough");
+    }
+    const container = document.createElement("div");
+    container.className = "consenti-modal__container";
+    const header = document.createElement("div");
+    header.className = "consenti-modal__header";
+    if (config.heading) {
+      const headingTag = config.headingTag ?? "h2";
+      const heading = document.createElement(headingTag);
+      heading.id = "consenti-modal-heading";
+      heading.className = "consenti-modal__heading";
+      heading.textContent = config.heading;
+      header.appendChild(heading);
+      wrapper.setAttribute("aria-labelledby", "consenti-modal-heading");
+    }
+    const hasClose = config.showClose !== false;
+    const hasLocaleSwitcher = config.showLocaleSwitcher && locales && locales.length > 1;
+    if (hasLocaleSwitcher || hasClose) {
+      const headerControls = document.createElement("div");
+      headerControls.className = "consenti-modal__header-controls";
+      if (hasLocaleSwitcher && locales && onLocaleSwitch) {
+        headerControls.appendChild(buildModalLocaleSwitcher(locales, activeLocale, onLocaleSwitch));
+      }
+      if (hasClose) {
+        const close = document.createElement("button");
+        close.type = "button";
+        close.className = "consenti-modal__close consenti-btn consenti-btn--close";
+        close.setAttribute("aria-label", "Close preference modal");
+        close.textContent = "\xD7";
+        close.addEventListener("click", handlers.onClose);
+        headerControls.appendChild(close);
+      }
+      header.appendChild(headerControls);
+    }
+    container.appendChild(header);
+    if (config.subheading) {
+      const sub = document.createElement("p");
+      sub.className = "consenti-modal__subheading";
+      sub.textContent = config.subheading;
+      container.appendChild(sub);
+    }
+    if (config.htmlText) {
+      const desc = document.createElement("div");
+      desc.className = "consenti-modal__text";
+      desc.innerHTML = config.htmlText;
+      container.appendChild(desc);
+    }
+    const linkButtons = config.buttons.filter((b) => b.action === "link");
+    if (linkButtons.length > 0) {
+      const linksContainer = document.createElement("div");
+      linksContainer.className = "consenti-modal__links";
+      for (const btn of linkButtons) {
+        if (!btn.url) continue;
+        const anchor = document.createElement("a");
+        anchor.href = btn.url;
+        anchor.className = `consenti-modal__link consenti-btn consenti-btn--${btn.style ?? "text"}`;
+        anchor.textContent = btn.text;
+        anchor.setAttribute("target", "_blank");
+        anchor.setAttribute("rel", "noopener noreferrer");
+        linksContainer.appendChild(anchor);
+      }
+      container.appendChild(linksContainer);
+    }
+    const body = document.createElement("div");
+    body.className = "consenti-modal__body";
+    const categories = document.createElement("div");
+    categories.className = "consenti-modal__categories";
+    for (const cat of config.categories) {
+      const catEl = this.buildCategory(cat, initialConsent);
+      categories.appendChild(catEl);
+    }
+    body.appendChild(categories);
+    container.appendChild(body);
+    if (allowReceipt) {
+      container.appendChild(this.buildReceiptOption());
+    }
+    if (dpdpaConfig) {
+      const notice = document.createElement("div");
+      notice.className = "consenti-modal__dpdpa-notice";
+      notice.innerHTML = [
+        `<strong>Data Fiduciary:</strong> ${dpdpaConfig.dataFiduciary}.`,
+        dpdpaConfig.purposeDescription ? ` <strong>Purpose:</strong> ${dpdpaConfig.purposeDescription}.` : "",
+        ` You may withdraw consent at any time or contact our Grievance Officer at`,
+        ` <a href="mailto:${dpdpaConfig.grievanceEmail}">${dpdpaConfig.grievanceEmail}</a>.`
+      ].join("");
+      container.appendChild(notice);
+    }
+    const btns = document.createElement("div");
+    btns.className = "consenti-modal__buttons";
+    for (const btn of config.buttons.filter((b) => b.action !== "link")) {
+      btns.appendChild(buildButton(btn, handlers));
+    }
+    container.appendChild(btns);
+    wrapper.appendChild(container);
+    wrapper.addEventListener("consenti:closeRequest", () => handlers.onClose());
+    this.el = wrapper;
+  }
+  buildCategory(cat, initialConsent) {
+    const isLI = cat.type === "legitimate_interest";
+    const isMandatory = cat.mandatory === true;
+    let defaultOn;
+    if (isMandatory) {
+      defaultOn = true;
+    } else if (isLI) {
+      defaultOn = initialConsent[cat.cookies[0] ?? ""] !== "objected";
+    } else {
+      defaultOn = initialConsent[cat.cookies[0] ?? ""] === "granted";
+    }
+    this.toggleState.set(cat.id, defaultOn);
+    const wrapper = document.createElement("div");
+    wrapper.className = `consenti-category${isMandatory ? " consenti-category--mandatory" : ""}`;
+    const header = document.createElement("div");
+    header.className = "consenti-category__header";
+    const headingTag = cat.headingTag ?? "h3";
+    const heading = document.createElement(headingTag);
+    heading.id = `consenti-cat-${cat.id}-heading`;
+    heading.className = "consenti-category__heading";
+    heading.textContent = cat.heading;
+    header.appendChild(heading);
+    const toggle = document.createElement("button");
+    toggle.type = "button";
+    toggle.className = `consenti-category__toggle${isMandatory ? " consenti-category__toggle--mandatory" : ""}`;
+    toggle.setAttribute("role", "switch");
+    toggle.setAttribute("aria-checked", String(defaultOn));
+    toggle.setAttribute("aria-labelledby", `consenti-cat-${cat.id}-heading`);
+    if (isMandatory) toggle.setAttribute("aria-disabled", "true");
+    const knob = document.createElement("span");
+    knob.className = "consenti-category__toggle-knob";
+    knob.setAttribute("aria-hidden", "true");
+    toggle.appendChild(knob);
+    if (!isMandatory) {
+      toggle.addEventListener("click", () => {
+        const current = this.toggleState.get(cat.id) ?? false;
+        const next = !current;
+        this.toggleState.set(cat.id, next);
+        toggle.setAttribute("aria-checked", String(next));
+      });
+    }
+    this.toggleMap.set(cat.id, toggle);
+    header.appendChild(toggle);
+    wrapper.appendChild(header);
+    const text = document.createElement("div");
+    text.className = "consenti-category__text";
+    text.innerHTML = cat.htmlText;
+    wrapper.appendChild(text);
+    if (isLI && cat.legitimateInterest?.description) {
+      const li = document.createElement("p");
+      li.className = "consenti-category__li-desc";
+      li.textContent = cat.legitimateInterest.description;
+      wrapper.appendChild(li);
+    }
+    return wrapper;
+  }
+  buildReceiptOption() {
+    const wrapper = document.createElement("div");
+    wrapper.className = "consenti-modal__receipt-option";
+    const label = document.createElement("label");
+    label.className = "consenti-modal__receipt-label";
+    const checkbox = document.createElement("input");
+    checkbox.type = "checkbox";
+    checkbox.className = "consenti-modal__receipt-checkbox";
+    checkbox.id = "consenti-receipt-checkbox";
+    checkbox.setAttribute("aria-describedby", "consenti-receipt-desc");
+    this.receiptCheckbox = checkbox;
+    label.appendChild(checkbox);
+    label.append(" Get a copy of my consent choices (JSON)");
+    wrapper.appendChild(label);
+    const desc = document.createElement("p");
+    desc.id = "consenti-receipt-desc";
+    desc.className = "consenti-modal__receipt-desc";
+    desc.textContent = "A JSON file will be downloaded to your device when you save your preferences.";
+    wrapper.appendChild(desc);
+    return wrapper;
+  }
+  /**
+   * Appends the modal to `document.body` and activates the focus trap.
+   * The receipt checkbox (if present) is reset to unchecked.
+   *
+   * @param triggerEl - The element that opened the modal. Focus returns here on `close()`.
+   */
+  open(triggerEl) {
+    if (!this.el) return;
+    this.triggerEl = triggerEl ?? document.activeElement;
+    if (this.receiptCheckbox) this.receiptCheckbox.checked = false;
+    document.body.appendChild(this.el);
+    if (!this.passthrough) {
+      this.trapCleanup = trapFocus(this.el);
+    }
+  }
+  /**
+   * Removes the modal from `document.body`, deactivates the focus trap,
+   * and returns focus to `triggerEl`.
+   */
+  close() {
+    this.trapCleanup?.();
+    this.trapCleanup = null;
+    this.el?.remove();
+    this.triggerEl?.focus();
+    this.triggerEl = null;
+  }
+  /** Returns `true` if the modal is currently mounted in the document. */
+  isOpen() {
+    return this.el?.isConnected === true;
+  }
+  /** Returns `true` if the receipt download checkbox is checked at the time of calling. */
+  isReceiptRequested() {
+    return this.receiptCheckbox?.checked ?? false;
+  }
+  /**
+   * Reads the current toggle state map and converts it to a `ConsentValue`.
+   *
+   * Called by the submit handler to build the consent object before writing to storage.
+   *
+   * @param categories - The category list from the resolved profile (provides cookie IDs and type).
+   */
+  getToggleConsent(categories) {
+    const consent = {};
+    for (const cat of categories) {
+      const isLI = cat.type === "legitimate_interest";
+      const isMandatory = cat.mandatory === true;
+      const on = this.toggleState.get(cat.id) ?? false;
+      for (const cookieId of cat.cookies) {
+        if (isMandatory) {
+          consent[cookieId] = "granted";
+        } else if (isLI) {
+          consent[cookieId] = on ? "granted" : "objected";
+        } else {
+          consent[cookieId] = on ? "granted" : "denied";
+        }
+      }
+    }
+    return consent;
+  }
+  /** Removes the modal element from the DOM and clears all internal state. */
+  destroy() {
+    this.trapCleanup?.();
+    this.el?.remove();
+    this.el = null;
+    this.toggleMap.clear();
+    this.toggleState.clear();
+    this.receiptCheckbox = null;
+  }
+};
+function buildModalLocaleSwitcher(locales, activeLocale, onSwitch) {
+  const wrapper = document.createElement("div");
+  wrapper.className = "consenti-locale-switcher consenti-locale-switcher--modal";
+  const btn = document.createElement("button");
+  btn.type = "button";
+  btn.className = "consenti-locale-switcher__btn consenti-btn consenti-btn--close";
+  btn.setAttribute("aria-label", "Switch language");
+  btn.setAttribute("aria-haspopup", "listbox");
+  btn.textContent = "\u{1F310}";
+  const list = document.createElement("ul");
+  list.className = "consenti-locale-switcher__list";
+  list.setAttribute("role", "listbox");
+  list.setAttribute("aria-label", "Select language");
+  list.hidden = true;
+  for (const locale of locales) {
+    const item = document.createElement("li");
+    item.setAttribute("role", "option");
+    item.setAttribute("aria-selected", String(locale === activeLocale));
+    const localeBtn = document.createElement("button");
+    localeBtn.type = "button";
+    localeBtn.className = `consenti-locale-switcher__option${locale === activeLocale ? " consenti-locale-switcher__option--active" : ""}`;
+    localeBtn.textContent = locale;
+    localeBtn.addEventListener("click", (e) => {
+      e.stopPropagation();
+      list.hidden = true;
+      if (locale !== activeLocale) onSwitch(locale);
+    });
+    item.appendChild(localeBtn);
+    list.appendChild(item);
+  }
+  btn.addEventListener("click", (e) => {
+    e.stopPropagation();
+    list.hidden = !list.hidden;
+  });
+  document.addEventListener("click", () => {
+    list.hidden = true;
+  }, { capture: true, once: false });
+  wrapper.appendChild(btn);
+  wrapper.appendChild(list);
+  return wrapper;
+}
+
+// src/ui/renderer.ts
+var ROOT_ID = "consenti-root";
+var Renderer = class {
+  constructor() {
+    this.root = null;
+    this.styleEl = null;
+  }
+  /**
+   * Returns the mount-point element, creating `#consenti-root` if needed.
+   *
+   * When `rootEl` is supplied:
+   * - `string` → resolved via `document.querySelector`. Throws if no match.
+   * - `HTMLElement` → used directly. Throws if not attached to the document.
+   * On subsequent calls the previously stored root is returned immediately.
+   *
+   * @throws `Error` if called in SSR or if a supplied `rootEl` cannot be resolved.
+   */
+  mount(rootEl) {
+    if (!isClient()) throw new Error("[Consenti] Renderer.mount() called in SSR context");
+    if (this.root) return this.root;
+    if (rootEl !== void 0) {
+      if (typeof rootEl === "string") {
+        const found = document.querySelector(rootEl);
+        if (!found) throw new Error(`[Consenti] rootEl selector "${rootEl}" did not match any element.`);
+        this.root = found;
+      } else {
+        if (!document.contains(rootEl)) throw new Error("[Consenti] rootEl element is not attached to the document.");
+        this.root = rootEl;
+      }
+      return this.root;
+    }
+    let root = document.getElementById(ROOT_ID);
+    if (!root) {
+      root = document.createElement("div");
+      root.id = ROOT_ID;
+      document.body.appendChild(root);
+    }
+    this.root = root;
+    return root;
+  }
+  /**
+   * Injects a `<style id="consenti-styles">` tag into `<head>` with the given CSS string.
+   * No-ops if the style element already exists (idempotent).
+   *
+   * @param css - The CSS content to inject.
+   */
+  injectStyles(css) {
+    if (!isClient()) return;
+    if (this.styleEl) return;
+    const style = document.createElement("style");
+    style.id = "consenti-styles";
+    style.textContent = css;
+    document.head.appendChild(style);
+    this.styleEl = style;
+  }
+  /** Removes `#consenti-root` and the injected `<style>` tag from the document. */
+  unmount() {
+    this.root?.remove();
+    this.styleEl?.remove();
+    this.root = null;
+    this.styleEl = null;
+  }
+  /**
+   * Announces a message to screen readers via a visually-hidden `aria-live="polite"` region.
+   *
+   * The region is created on first call and reused. The message is cleared then
+   * re-set via `requestAnimationFrame` to guarantee the change is detected by
+   * AT even if the same string is announced twice in a row.
+   *
+   * @param message - The message to announce (plain text, not HTML).
+   */
+  announceToScreenReader(message) {
+    if (!isClient()) return;
+    let announcer = document.getElementById("consenti-announcer");
+    if (!announcer) {
+      announcer = document.createElement("div");
+      announcer.id = "consenti-announcer";
+      announcer.setAttribute("role", "status");
+      announcer.setAttribute("aria-live", "polite");
+      announcer.setAttribute("aria-atomic", "true");
+      announcer.style.cssText = "position:absolute;width:1px;height:1px;padding:0;overflow:hidden;clip:rect(0,0,0,0);white-space:nowrap;border:0;";
+      document.body.appendChild(announcer);
+    }
+    announcer.textContent = "";
+    requestAnimationFrame(() => {
+      if (announcer) announcer.textContent = message;
+    });
+  }
+};
+
+// src/core/consenti-setup.ts
+var ConsentiSetup = class {
+  /**
+   * Creates and initialises the consent widget.
+   *
+   * Construction is synchronous; the async `init()` is launched in the background.
+   * Use `await widget.ready` or `widget.onReady(cb)` to run code after init completes.
+   *
+   * @param config - Widget configuration. See `ConsentiConfig` for all options.
+   */
+  constructor(config) {
+    this.config = config;
+    this.initialized = false;
+    this.initializing = false;
+    this.profile = null;
+    this.consentStore = null;
+    this.eventBus = null;
+    this.banner = null;
+    this.modal = null;
+    this.renderer = null;
+    this.broadcastChannel = new ConsentiChannel();
+    this.plugins = [];
+    /** Tracks which banner variant is currently visible, or null when hidden. */
+    this._bannerVariant = null;
+    this.readyPromise = new Promise((resolve) => {
+      this.readyResolve = resolve;
+    });
+    if (!isClient()) return;
+    if (config.api?.enabled && config.core.storage === "localStorage") {
+      console.warn(
+        "[Consenti] localStorage storage mode cannot be used with API mode (API sets cookies via Set-Cookie header). Falling back to cookie storage."
+      );
+      config.core.storage = "cookie";
+    }
+    if (config.autoInit !== false) {
+      this.init().catch((err) => console.warn("[Consenti] Init error:", err));
+    }
+  }
+  profileId() {
+    return this.config.core.profileId ?? 0;
+  }
+  /**
+   * Starts widget initialisation. Called automatically unless `autoInit: false` is set.
+   * Can be called explicitly after construction when `autoInit: false`, or after `destroy()`
+   * to re-initialise the same instance.
+   */
+  async init() {
+    if (!isClient()) return;
+    if (this.initializing) return;
+    this.initializing = true;
+    this.initialized = false;
+    this.readyPromise = new Promise((resolve) => {
+      this.readyResolve = resolve;
+    });
+    try {
+      const storageMode = this.config.core.storage ?? "cookie";
+      const userId = this.config.core.userId ?? ConsentStore.getOrCreateUserId(this.profileId(), storageMode);
+      this.profile = await resolveProfile(this.config);
+      if (this.config.profileOverride) {
+        this.profile = { ...this.profile, ...this.config.profileOverride };
+      }
+      this.eventBus = new EventBus(this.profileId(), this.config.utils?.gtm);
+      this.consentStore = new ConsentStore(
+        userId,
+        this.profileId(),
+        storageMode,
+        this.config.core.cookieDomains
+      );
+      this.renderer = new Renderer();
+      if (!this.config.core.disableCssTemplate && CONSENTI_CSS) {
+        this.renderer.injectStyles(CONSENTI_CSS);
+      }
+      this.banner = new Banner();
+      this.modal = new Modal();
+      this.applyTheme();
+      this.applyDarkMode();
+      this.broadcastChannel.connect((msg) => this.handleBroadcastMessage(msg));
+      await this.runPlugins();
+      const signingKey = this.profile.cookieSigningKey ?? this.config.core.cookieSigningKey;
+      const existing = this.config.core.signCookies && signingKey ? await this.consentStore.readAndVerify(signingKey) : this.consentStore.read();
+      const hasExisting = existing !== null;
+      this.eventBus.dispatch("consenti:bannerInitialized", {
+        profileId: this.profileId(),
+        hasExistingConsent: hasExisting
+      });
+      const gpcMode = this.config.core.autoHonorGPC ?? false;
+      if (gpcMode && detectGPC()) {
+        const gpcConsent = applyGPCToConsent(this.profile.cookies, {}, gpcMode);
+        if (gpcMode === "strict") {
+          await this.submitConsent(gpcConsent, true);
+          this.initialized = true;
+          this.readyResolve();
+          return;
+        }
+        if (!hasExisting) {
+          const gpcSigningKey = this.profile.cookieSigningKey ?? this.config.core.cookieSigningKey;
+          if (this.config.core.signCookies && gpcSigningKey && this.consentStore) {
+            this.lastSignature = await this.consentStore.writeAndSign(gpcConsent, gpcSigningKey);
+          } else {
+            this.consentStore?.write(gpcConsent);
+          }
+          this.broadcastChannel.send({
+            type: "consentUpdated",
+            consent: gpcConsent,
+            profileId: this.profileId()
+          });
+          this.eventBus?.dispatch("consenti:consentSubmitted", {
+            consent: gpcConsent,
+            gpcDetected: true,
+            consentId: crypto.randomUUID(),
+            consentAction: this.deriveAction(gpcConsent, false),
+            pageUrl: window.location.href
+          });
+          this.showBanner(true);
+          this.initialized = true;
+          this.readyResolve();
+          return;
+        }
+      }
+      const regulation = this.config.core.regulation ?? "gdpr";
+      if (regulation === "ccpa" && !hasExisting) {
+        const defaultConsent = {};
+        for (const cookie of this.profile.cookies) {
+          defaultConsent[cookie.id] = "granted";
+        }
+        const ccpaSigKey = this.profile.cookieSigningKey ?? this.config.core.cookieSigningKey;
+        if (this.config.core.signCookies && ccpaSigKey) {
+          await this.consentStore.writeAndSign(defaultConsent, ccpaSigKey);
+        } else {
+          this.consentStore.write(defaultConsent);
+        }
+        this.initialized = true;
+        this.readyResolve();
+        return;
+      }
+      if (regulation === "cpra" && !hasExisting) {
+        const gpcActive = this.config.core.autoHonorGPC && detectGPC();
+        const defaultConsent = {};
+        for (const cookie of this.profile.cookies) {
+          if (cookie.mandatory) {
+            defaultConsent[cookie.id] = "granted";
+            continue;
+          }
+          if (cookie.cpraCategory === "sensitive") {
+            defaultConsent[cookie.id] = "denied";
+          } else if (gpcActive && (cookie.cpraCategory === "sale" || cookie.cpraCategory === "sharing")) {
+            defaultConsent[cookie.id] = "denied";
+          } else {
+            defaultConsent[cookie.id] = "granted";
+          }
+        }
+        const sigKey = this.profile.cookieSigningKey ?? this.config.core.cookieSigningKey;
+        if (this.config.core.signCookies && sigKey) {
+          await this.consentStore.writeAndSign(defaultConsent, sigKey);
+        } else {
+          this.consentStore.write(defaultConsent);
+        }
+        this.initialized = true;
+        this.readyResolve();
+        return;
+      }
+      if (!hasExisting) {
+        this.showBanner();
+      }
+      this.initialized = true;
+      this.readyResolve();
+    } finally {
+      this.initializing = false;
+    }
+  }
+  /** Applies the `consenti-root--dark` class based on config or profile flag. */
+  applyDarkMode() {
+    if (!this.renderer) return;
+    const isDark = this.config.darkMode ?? this.profile?.darkMode ?? false;
+    const root = this.renderer.mount(this.config.rootEl);
+    if (isDark) {
+      root.classList.add("consenti-root--dark");
+    } else {
+      root.classList.remove("consenti-root--dark");
+    }
+  }
+  /**
+   * Injects CSS custom property overrides supplied via `core.theme` into the
+   * Consenti root element so they cascade down to all widget elements.
+   */
+  applyTheme() {
+    const theme = this.config.core.theme;
+    if (!theme || !this.renderer) return;
+    const map = {
+      "--consenti-color-bg": theme.bgColor,
+      "--consenti-color-text": theme.textColor,
+      "--consenti-color-primary": theme.primaryColor,
+      "--consenti-color-primary-text": theme.primaryTextColor,
+      "--consenti-color-secondary": theme.secondaryColor,
+      "--consenti-color-secondary-text": theme.secondaryTextColor,
+      "--consenti-color-border": theme.borderColor,
+      "--consenti-font-family": theme.fontFamily,
+      "--consenti-font-size-base": theme.fontSizeBase,
+      "--consenti-font-size-heading": theme.fontSizeHeading,
+      "--consenti-border-radius": theme.borderRadius,
+      "--consenti-border-radius-btn": theme.buttonBorderRadius,
+      "--consenti-toggle-bg-on": theme.toggleBgOn,
+      "--consenti-toggle-bg-off": theme.toggleBgOff,
+      "--consenti-color-accent": theme.accentColor,
+      "--consenti-color-accent-text": theme.accentTextColor
+    };
+    const root = this.renderer.mount(this.config.rootEl);
+    for (const [prop, value] of Object.entries(map)) {
+      if (value !== void 0) root.style.setProperty(prop, value);
+    }
+    if (theme.fontSizeMultiplier) {
+      const mult = parseFloat(theme.fontSizeMultiplier);
+      if (!isNaN(mult)) {
+        const baseSize = parseFloat(getComputedStyle(root).getPropertyValue("--consenti-font-size-base") || "14");
+        const headingSize = parseFloat(getComputedStyle(root).getPropertyValue("--consenti-font-size-heading") || "16");
+        root.style.setProperty("--consenti-font-size-base", `${Math.round(baseSize * mult)}px`);
+        root.style.setProperty("--consenti-font-size-heading", `${Math.round(headingSize * mult)}px`);
+      }
+    }
+  }
+  async runPlugins() {
+    this.plugins = this.config.plugins ?? [];
+    for (const plugin of this.plugins) {
+      try {
+        await plugin.initialize(this);
+      } catch (err) {
+        console.warn("[Consenti] Plugin initialize error:", err);
+      }
+    }
+  }
+  /**
+   * Invokes an optional plugin hook on all registered plugins.
+   * Async hooks are awaited; errors are caught and logged so a broken plugin
+   * never interferes with the consent flow.
+   *
+   * @param invoke - Function that calls the desired hook method on a single plugin.
+   */
+  async callPluginHook(invoke) {
+    for (const plugin of this.plugins) {
+      try {
+        await invoke(plugin, this);
+      } catch (err) {
+        console.warn("[Consenti] Plugin hook failed:", err);
+      }
+    }
+  }
+  buildHandlers(context) {
+    return {
+      onGrantAll: () => {
+        const consent = {};
+        for (const cookie of this.profile?.cookies ?? []) {
+          consent[cookie.id] = "granted";
+        }
+        void this.submitConsent(consent);
+        if (context === "banner") {
+          this.banner?.hide();
+          this._bannerVariant = null;
+        }
+      },
+      onDenyAll: () => {
+        const consent = {};
+        for (const cookie of this.profile?.cookies ?? []) {
+          consent[cookie.id] = cookie.mandatory ? "granted" : "denied";
+        }
+        void this.submitConsent(consent);
+        if (context === "banner") {
+          this.banner?.hide();
+          this._bannerVariant = null;
+        }
+      },
+      onSubmit: () => {
+        if (context === "modal" && this.modal && this.profile) {
+          const consent = this.modal.getToggleConsent(this.profile.preferenceModal.categories);
+          void this.submitConsent(consent);
+          this.hideModal();
+        } else {
+          const consent = {};
+          for (const cookie of this.profile?.cookies ?? []) {
+            if (cookie.mandatory) consent[cookie.id] = "granted";
+          }
+          void this.submitConsent(consent);
+          if (context === "banner") {
+            this.banner?.hide();
+            this._bannerVariant = null;
+          }
+        }
+      },
+      onManage: () => {
+        this.showModal();
+      },
+      onClose: () => {
+        if (context === "modal") {
+          this.hideModal();
+        } else {
+          this.banner?.hide();
+          this._bannerVariant = null;
+          this.broadcastChannel.send({ type: "bannerClosed" });
+          this.eventBus?.dispatch("consenti:bannerVisibility", { show: false, action: true });
+          void this.callPluginHook((p) => p.onBannerHide?.());
+        }
+      },
+      onGrantSpecific: (cookieIds) => {
+        const consent = {};
+        for (const cookie of this.profile?.cookies ?? []) {
+          if (cookie.mandatory || cookieIds.includes(cookie.id)) {
+            consent[cookie.id] = "granted";
+          } else {
+            consent[cookie.id] = "denied";
+          }
+        }
+        void this.submitConsent(consent);
+        if (context === "banner") this.hideBanner();
+      }
+    };
+  }
+  /**
+   * Classifies a consent submission as `accept_all`, `reject_all`, `custom`, or `update`.
+   * Used to enrich events and API payloads with intent metadata.
+   */
+  deriveAction(fullConsent, hadExistingConsent) {
+    if (hadExistingConsent) return "update";
+    const nonMandatory = this.profile?.cookies.filter((c) => !c.mandatory) ?? [];
+    if (nonMandatory.length === 0) return "custom";
+    const allGranted = nonMandatory.every((c) => fullConsent[c.id] === "granted");
+    const allDenied = nonMandatory.every(
+      (c) => fullConsent[c.id] === "denied" || fullConsent[c.id] === "objected"
+    );
+    if (allGranted) return "accept_all";
+    if (allDenied) return "reject_all";
+    return "custom";
+  }
+  handleBroadcastMessage(msg) {
+    switch (msg.type) {
+      case "consentUpdated":
+        if (msg.profileId !== this.profileId()) return;
+        this.consentStore?.setInMemory(msg.consent);
+        this.banner?.hide();
+        if (this.modal?.isOpen()) this.modal.close();
+        this.eventBus?.dispatch("consenti:consentSubmitted", {
+          consent: msg.consent,
+          fromBroadcast: true
+        });
+        break;
+      case "bannerClosed":
+        this.banner?.hide();
+        this._bannerVariant = null;
+        break;
+      case "consentDeleted":
+        this.consentStore?.clearInMemory();
+        break;
+    }
+  }
+  // ─── Public API ──────────────────────────────────────────────────────────────
+  /**
+   * Returns `true` if the visitor has saved consent for the active profile.
+   * Always returns `false` during SSR.
+   */
+  hasConsent() {
+    if (!isClient()) return false;
+    return this.consentStore?.hasConsent() ?? false;
+  }
+  /**
+   * Returns the stored consent map, or `null` if no consent has been saved.
+   * Always returns `null` during SSR.
+   */
+  getConsent() {
+    if (!isClient()) return null;
+    return this.consentStore?.getConsent() ?? null;
+  }
+  /**
+   * Returns the `Date` when consent was last saved, or `false` if no consent exists.
+   * Always returns `false` during SSR.
+   */
+  getConsentDate() {
+    if (!isClient()) return false;
+    return this.consentStore?.getConsentDate() ?? false;
+  }
+  /**
+   * Returns the consent map in Google Consent Mode v2 format, ready to pass to
+   * `gtag('consent', 'update', ...)`. Returns `null` if no consent has been saved.
+   *
+   * Maps Consenti cookie IDs to the seven Google Consent Mode v2 parameters.
+   * Cookies whose IDs exactly match a GCM v2 key are forwarded directly.
+   * Non-GCM cookies are ignored by this method (they appear in `getConsent()` only).
+   */
+  getGTMConsent() {
+    const consent = this.getConsent();
+    if (!consent) return null;
+    const gcmKeys = [
+      "ad_storage",
+      "analytics_storage",
+      "ad_user_data",
+      "ad_personalization",
+      "functionality_storage",
+      "personalization_storage",
+      "security_storage"
+    ];
+    const result = {};
+    for (const key of gcmKeys) {
+      const raw = consent[key];
+      if (raw === "granted") {
+        result[key] = "granted";
+      } else if (raw === "denied" || raw === "objected") {
+        result[key] = "denied";
+      } else {
+        const safeDefault = key === "functionality_storage" || key === "security_storage" ? "granted" : "denied";
+        result[key] = safeDefault;
+      }
+    }
+    return result;
+  }
+  /**
+   * Records and persists the user's consent choices.
+   *
+   * Mandatory cookies are always forced to `'granted'` regardless of what is passed.
+   * Non-mandatory cookies not present in `consent` default to `'denied'`.
+   *
+   * @param consent    - Partial or full map of cookie ID → status.
+   * @param gpcDerived - Internal flag set to `true` when called from the GPC strict path.
+   */
+  async submitConsent(consent, gpcDerived = false) {
+    if (!isClient() || !this.profile || !this.consentStore) return;
+    const regulation = this.config.core.regulation ?? "gdpr";
+    const hadExistingConsent = this.consentStore.hasConsent();
+    const consentId = crypto.randomUUID();
+    const pageUrl = window.location.href;
+    const fullConsent = {};
+    for (const cookie of this.profile.cookies) {
+      if (cookie.mandatory) {
+        fullConsent[cookie.id] = "granted";
+      } else if (regulation === "cpra") {
+        const fallback = cookie.cpraCategory === "sensitive" ? "denied" : "granted";
+        fullConsent[cookie.id] = consent[cookie.id] ?? fallback;
+      } else {
+        fullConsent[cookie.id] = consent[cookie.id] ?? (regulation === "ccpa" ? "granted" : "denied");
+      }
+    }
+    const consentAction = this.deriveAction(fullConsent, hadExistingConsent);
+    this.eventBus?.dispatch("consenti:consentBeingSubmitted", { consent: fullConsent, consentId });
+    let apiResponse;
+    if (this.config.api?.enabled) {
+      try {
+        const base = this.config.api.baseUrl ?? window.location.origin;
+        const { httpRequest: httpRequest2 } = await import("./http-VHOGZ6ZJ.mjs");
+        apiResponse = await httpRequest2(
+          `${base}/consenti/api/v1/consent`,
+          {
+            method: "POST",
+            body: JSON.stringify({
+              profileId: this.profileId(),
+              consent: fullConsent,
+              locale: this.config.core.locale ?? "en",
+              gpcDetected: gpcDerived || detectGPC(),
+              consentId,
+              action: consentAction,
+              pageUrl
+            })
+          },
+          this.config.api.authToken
+        );
+      } catch (err) {
+        console.warn("[Consenti] API consent submission failed:", err);
+      }
+    }
+    const signingKey = this.profile.cookieSigningKey ?? this.config.core.cookieSigningKey;
+    if (this.config.core.signCookies && signingKey) {
+      this.lastSignature = await this.consentStore.writeAndSign(fullConsent, signingKey);
+    } else {
+      this.consentStore.write(fullConsent);
+    }
+    const receiptRequested = this.modal?.isReceiptRequested() ?? false;
+    if (receiptRequested && this.config.core.allowReceipt) {
+      const nameParts = this.consentStore.cookieName.split("_");
+      const visitorId = nameParts.slice(1, -1).join("_");
+      const receiptParams = {
+        visitorId,
+        profileId: this.profileId(),
+        profileVersion: this.profile.version,
+        locale: this.config.core.locale ?? "en",
+        consent: fullConsent,
+        ...this.lastSignature ? { signature: this.lastSignature } : {}
+      };
+      const receipt = generateReceipt(receiptParams);
+      downloadReceipt(receipt);
+    }
+    this.broadcastChannel.send({
+      type: "consentUpdated",
+      consent: fullConsent,
+      profileId: this.profileId()
+    });
+    this.eventBus?.dispatch("consenti:consentSubmitted", {
+      consent: fullConsent,
+      apiResponse,
+      gpcDetected: gpcDerived,
+      consentId,
+      consentAction,
+      pageUrl
+    });
+    await this.callPluginHook((p) => p.onConsentSubmit?.(fullConsent));
+    this.renderer?.announceToScreenReader("Your cookie preferences have been saved.");
+    this.hideBanner();
+    if (this.modal?.isOpen()) this.hideModal();
+  }
+  /**
+   * Returns the currently visible banner variant, or `false` if no banner is shown.
+   * Useful for programmatically checking state before calling `showBanner` / `hideBanner`.
+   */
+  bannerVisibility() {
+    return this._bannerVariant ?? false;
+  }
+  /**
+   * Returns `'preference'` when the preference modal is open, or `false` when closed.
+   */
+  modalVisibility() {
+    return this.modal?.isOpen() ? "preference" : false;
+  }
+  /**
+   * Mounts and shows the consent banner.
+   *
+   * No-ops if the requested variant is already visible. If a different variant is
+   * currently shown (e.g. switching from main to GPC), the existing banner is replaced.
+   *
+   * @param useGpcVariant - When `true` and the profile has a `gpcBanner`, that variant
+   *                        is shown instead of `mainBanner`. Used by the GPC flow.
+   */
+  showBanner(useGpcVariant = false) {
+    if (!isClient() || !this.profile || !this.banner || !this.renderer) return;
+    const variant = useGpcVariant && this.profile.gpcBanner ? "gpc" : "main";
+    if (this._bannerVariant === variant) return;
+    const bannerConfig = variant === "gpc" ? this.profile.gpcBanner : this.profile.mainBanner;
+    const root = this.renderer.mount(this.config.rootEl);
+    const handlers = this.buildHandlers("banner");
+    this.banner.remove();
+    const locales = this.profile.locales;
+    const activeLocale = this.config.core.locale ?? "en";
+    const bannerEl = this.banner.build(
+      bannerConfig,
+      handlers,
+      this.config.core.privacyPolicyUrl,
+      locales,
+      activeLocale,
+      (locale) => this.switchLocale(locale)
+    );
+    root.appendChild(bannerEl);
+    const overlay = this.banner.getOverlay();
+    if (overlay) root.appendChild(overlay);
+    this._bannerVariant = variant;
+    this.eventBus?.dispatch("consenti:bannerVisibility", { show: true, action: false });
+    void this.callPluginHook((p) => p.onBannerShow?.());
+  }
+  /** Hides the banner and notifies other tabs via BroadcastChannel. No-op if already hidden. */
+  hideBanner() {
+    if (this._bannerVariant === null) return;
+    this.banner?.hide();
+    this._bannerVariant = null;
+    this.broadcastChannel.send({ type: "bannerClosed" });
+    this.eventBus?.dispatch("consenti:bannerVisibility", { show: false, action: true });
+    this.renderer?.announceToScreenReader("Cookie banner dismissed.");
+    void this.callPluginHook((p) => p.onBannerHide?.());
+  }
+  /**
+   * Opens the preference modal and hides the banner while the modal is open.
+   * No-ops if the modal is already open.
+   * If the modal is closed without saving consent, the banner is re-shown automatically
+   * (see `hideModal()`). Only one banner or modal is visible at a time.
+   *
+   * @param triggerEl - The element that triggered the modal open. Focus returns here on close.
+   */
+  showModal(triggerEl) {
+    if (!isClient() || !this.profile || !this.modal) return;
+    if (this.modal.isOpen()) return;
+    const handlers = this.buildHandlers("modal");
+    const existing = this.consentStore?.getConsent() ?? {};
+    const regulation = this.config.core.regulation ?? "gdpr";
+    const dpdpaCfg = regulation === "dpdpa" ? this.profile.dpdpa : void 0;
+    const locales = this.profile.locales;
+    const activeLocale = this.config.core.locale ?? "en";
+    this.modal.build(
+      this.profile.preferenceModal,
+      existing,
+      handlers,
+      this.config.core.allowReceipt ?? false,
+      dpdpaCfg,
+      locales,
+      activeLocale,
+      (locale) => {
+        this.hideModal();
+        this.switchLocale(locale);
+      }
+    );
+    this.banner?.hide();
+    this.modal.open(triggerEl);
+    const isDark = this.config.darkMode ?? this.profile?.darkMode ?? false;
+    document.getElementById("consenti-modal")?.classList.toggle("consenti-root--dark", isDark);
+    this.eventBus?.dispatch("consenti:modalVisibility", { show: true, action: true });
+    void this.callPluginHook((p) => p.onModalShow?.());
+  }
+  /**
+   * Closes the preference modal and returns focus to the element that opened it.
+   * No-ops if the modal is already closed.
+   * If the user has not yet given consent, the banner is re-shown automatically.
+   */
+  hideModal() {
+    if (!this.modal?.isOpen()) return;
+    this.modal.close();
+    this.eventBus?.dispatch("consenti:modalVisibility", { show: false, action: true });
+    void this.callPluginHook((p) => p.onModalHide?.());
+    if (!this.consentStore?.hasConsent() && this._bannerVariant !== null) {
+      this.banner?.show();
+    } else if (!this.consentStore?.hasConsent()) {
+      this.showBanner();
+    }
+  }
+  /**
+   * Registers a callback to run once the widget has finished initialising.
+   * If the widget is already initialised, the callback is invoked synchronously.
+   *
+   * @param callback - Function to call when the widget is ready.
+   */
+  onReady(callback) {
+    if (this.initialized) {
+      callback();
+    } else {
+      void this.readyPromise.then(callback);
+    }
+  }
+  /**
+   * A `Promise` that resolves once the widget has finished initialising.
+   * Equivalent to wrapping `onReady()` in a `Promise`.
+   *
+   * @example
+   * ```ts
+   * await widget.ready
+   * console.log('Widget ready')
+   * ```
+   */
+  get ready() {
+    return this.readyPromise;
+  }
+  /**
+   * Deletes the stored consent record and notifies other tabs.
+   * The banner will reappear on the next page load (or immediately if the
+   * receiving tab calls `showBanner()` in response to `consentDeleted`).
+   */
+  async deleteConsent() {
+    if (!isClient() || !this.consentStore) return;
+    if (this.config.api?.enabled) {
+      try {
+        const base = this.config.api.baseUrl ?? window.location.origin;
+        const visitorId = this.consentStore.cookieName;
+        const { httpRequest: httpRequest2 } = await import("./http-VHOGZ6ZJ.mjs");
+        await httpRequest2(
+          `${base}/consenti/api/v1/consent/${visitorId}`,
+          { method: "DELETE" },
+          this.config.api?.authToken
+        );
+      } catch (err) {
+        console.warn("[Consenti] API consent deletion failed:", err);
+      }
+    }
+    this.consentStore.delete();
+    this.broadcastChannel.send({ type: "consentDeleted" });
+  }
+  /**
+   * Removes existing consent and immediately re-shows the consent banner so the user
+   * can review and update their preferences.
+   *
+   * Equivalent to calling `deleteConsent()` followed by `showBanner()`, but in a single
+   * method so callers do not need to coordinate the async deletion with the banner display.
+   *
+   * Use this to power "Review my consent" links in footers or privacy dashboards.
+   */
+  async reConsent() {
+    await this.deleteConsent();
+    this.showBanner();
+  }
+  /**
+   * Returns the fully resolved profile for the current session, or `null` during the
+   * async init phase (before the profile has been fetched/resolved).
+   *
+   * Plugins can use this to read cookie definitions, banner config, modal categories,
+   * and the profile version without accessing internal state.
+   */
+  getProfile() {
+    return this.profile;
+  }
+  /**
+   * Returns the `#consenti-root` container element that wraps all widget DOM,
+   * or `null` before the widget has mounted or after `destroy()`.
+   *
+   * Plugins can use this to append custom elements, apply extra CSS variables,
+   * or observe mutations within the widget container.
+   */
+  getRootElement() {
+    if (!isClient()) return null;
+    if (this.config.rootEl) {
+      if (typeof this.config.rootEl === "string") {
+        return document.querySelector(this.config.rootEl);
+      }
+      return this.config.rootEl;
+    }
+    return document.getElementById("consenti-root");
+  }
+  /**
+   * Returns the `#consenti-banner` element when it is present in the DOM, or `null`.
+   * The element may be hidden (`display: none`) — check `bannerVisibility()` for visibility state.
+   *
+   * Useful for adding extra content, custom event listeners, or mutation observers on the banner.
+   */
+  getBannerElement() {
+    if (!isClient()) return null;
+    return document.getElementById("consenti-banner");
+  }
+  /**
+   * Returns the `#consenti-modal` element when the modal has been built, or `null`.
+   * The element is built on first `showModal()` call and reused on subsequent opens.
+   *
+   * Useful for injecting extra content into the modal or listening to modal-specific events.
+   */
+  getModalElement() {
+    if (!isClient()) return null;
+    return document.getElementById("consenti-modal");
+  }
+  /**
+   * Switches the active locale, re-resolves the profile, and re-renders the widget.
+   * Called by the locale switcher UI when the user selects a different language.
+   *
+   * @param locale - BCP 47 locale code to switch to (e.g. `'fr'`, `'de-AT'`).
+   */
+  switchLocale(locale) {
+    if (!isClient()) return;
+    this.config.core.locale = locale;
+    this.banner?.remove();
+    if (this.modal?.isOpen()) this.modal.close();
+    this._bannerVariant = null;
+    this.profile = null;
+    this.initialized = false;
+    this.readyPromise = new Promise((resolve) => {
+      this.readyResolve = resolve;
+    });
+    this.init().catch((err) => console.warn("[Consenti] Locale switch error:", err));
+  }
+  /**
+   * Destroys the widget — removes all DOM elements, disconnects the BroadcastChannel,
+   * and calls `destroy()` on all registered plugins.
+   *
+   * After `destroy()`, the instance should not be used again.
+   */
+  destroy() {
+    for (const plugin of this.plugins) {
+      try {
+        plugin.destroy();
+      } catch {
+      }
+    }
+    this.modal?.destroy();
+    this.renderer?.unmount();
+    this.broadcastChannel.disconnect();
+    this.banner = null;
+    this.modal = null;
+    this.renderer = null;
+    this.consentStore = null;
+    this.eventBus = null;
+    this.initialized = false;
+  }
+};
+
+// src/plugins/plugin.base.ts
+var ConsentiPlugin = class {
+};
+
+// src/profile/consenti-profile.ts
+var nextLocalId = 1e3;
+var ConsentiProfile = class {
+  /**
+   * @param config - Full profile configuration including cookies, locales, and UI text.
+   */
+  constructor(config) {
+    this.config = config;
+    this.id = nextLocalId++;
+    registerProfile(this.id, config);
+  }
+  /** Returns the auto-assigned numeric profile ID. Pass this to `core.profileId`. */
+  getId() {
+    return this.id;
+  }
+  /** Returns the raw `ProfileConfig` passed to the constructor. */
+  toJSON() {
+    return this.config;
+  }
+};
+
+// src/utils/consent-script.ts
+var ConsentScript = class {
+  constructor(options) {
+    this.options = options;
+    this.scriptEl = null;
+    this.handler = () => this.evaluate();
+    if (!isClient()) return;
+    window.addEventListener("consenti:consentSubmitted", this.handler);
+    this.evaluate();
+  }
+  evaluate() {
+    const consent = this.options.widget.getConsent();
+    const granted = consent?.[this.options.cookieId] === "granted";
+    if (granted && !this.scriptEl) {
+      this.inject();
+    } else if (!granted && this.scriptEl) {
+      this.revoke();
+    }
+  }
+  inject() {
+    const script = document.createElement("script");
+    if (this.options.src) script.src = this.options.src;
+    if (this.options.innerHTML) script.innerHTML = this.options.innerHTML;
+    for (const [key, value] of Object.entries(this.options.attributes ?? {})) {
+      script.setAttribute(key, value);
+    }
+    document.head.appendChild(script);
+    this.scriptEl = script;
+    this.options.onLoad?.();
+  }
+  revoke() {
+    this.scriptEl?.remove();
+    this.scriptEl = null;
+    this.options.onRevoke?.();
+  }
+  /**
+   * Removes the event listener and the injected `<script>` element (if present).
+   * Call this when the widget is destroyed or the script is no longer needed.
+   */
+  destroy() {
+    if (!isClient()) return;
+    window.removeEventListener("consenti:consentSubmitted", this.handler);
+    this.revoke();
+  }
+};
+
+// src/utils/cookie-trigger.ts
+var CookieTrigger = class {
+  constructor(options) {
+    const action = options.action ?? "modal";
+    this.clickHandler = () => {
+      if (action === "modal") options.widget.showModal();
+      else options.widget.showBanner();
+    };
+    if (!options.el) {
+      const btn = document.createElement("button");
+      btn.type = "button";
+      btn.className = "consenti-btn consenti-btn--text consenti-cookie-trigger";
+      btn.textContent = options.label ?? "Cookie Settings";
+      btn.setAttribute("aria-label", options.label ?? "Open cookie settings");
+      this.el = btn;
+      this.created = true;
+    } else if (typeof options.el === "string") {
+      if (!isClient()) {
+        this.el = document.createElement("span");
+        this.created = false;
+        return;
+      }
+      const found = document.querySelector(options.el);
+      if (!found) {
+        throw new Error(
+          `[Consenti] CookieTrigger: element not found for selector "${options.el}"`
+        );
+      }
+      this.el = found;
+      this.created = false;
+    } else {
+      this.el = options.el;
+      this.created = false;
+    }
+    this.el.addEventListener("click", this.clickHandler);
+  }
+  /**
+   * Returns the trigger element.
+   * When no `el` was provided, append the returned element to the desired location
+   * in the DOM after construction.
+   */
+  getElement() {
+    return this.el;
+  }
+  /**
+   * Removes the click handler and, if this instance auto-created the button,
+   * removes it from the DOM.
+   */
+  destroy() {
+    this.el.removeEventListener("click", this.clickHandler);
+    if (this.created) this.el.remove();
+  }
+};
+export {
+  ConsentScript,
+  ConsentiPlugin,
+  ConsentiProfile,
+  ConsentiSetup,
+  CookieTrigger
+};
+//# sourceMappingURL=index.mjs.map