@consenti/ui 0.4.0 → 0.6.0

package/dist/react.d.cts

@@ -64,6 +64,10 @@ type ComplianceType = 'auto' | ComplianceGroupId | (string & {}) | Symbol;
 
 interface ComplianceMapData {
     version: string;
+    /** `true` (default): this map replaces the embedded one entirely, so only the countries listed here
+     * resolve (server side). `false`: `countries` is merged over the embedded map — a listed country
+     * replaces its embedded entry wholesale, every unlisted country keeps its built-in mapping. */
+    override?: boolean;
     countries: Record<string, CountryComplianceEntry>;
 }
 interface CountryComplianceEntry {
@@ -83,6 +87,9 @@ interface ConsentDbRecord {
     tenantId: string;
     visitorId: string;
     profileId: string;
+    /** The profile's `version` when this consent was last given — with `profileId`, pins the exact
+     * on-disk snapshot (the banner text the visitor saw). Absent on records from before it was tracked. */
+    profileVersion?: number;
     locale: string;
     consentJson: ConsentValue;
     gpcDetected: boolean;
@@ -281,7 +288,12 @@ interface ResolvedProfile {
     /** Apply WCAG 2.1 AA accessibility enhancements to the widget. */
     enhanceAccessibility?: boolean;
 }
-type WidgetCountryResolverFn = () => Promise<{
+type WidgetCountryResolverFn = (hints: {
+    timezone: string;
+    language: string;
+    languages: string[];
+    locale: string;
+}) => Promise<{
     country: string | null;
     region: string | null;
     confidence: number;
@@ -340,8 +352,11 @@ interface ComplianceWidgetConfig {
      * document from (the browser's own HTTP cache honors whatever `Cache-Control`/`ETag` the
      * response sends — no custom caching here), or an inline operator-supplied `ComplianceMapData`
      * object. Invalid data from either a URL or an object logs a warning and falls back to
-     * `'default'`. Only overrides the country→group mapping — country/region detection itself
-     * always uses the embedded geo data. */
+     * `'default'`. Only overrides the country→group mapping — country/region detection itself always
+     * uses the embedded geo data. A country the map doesn't list falls back to the embedded mapping
+     * unless the document sets `override: true` (then it gets the strictest group, `'opt-in'`).
+     * Unlike the server, an omitted `override` is NOT `true` here: widget maps have always merged
+     * over the embedded mapping, and that stays the default. */
     complianceMap?: 'default' | string | ComplianceMapData;
     tcf?: TcfWidgetConfig;
     gpp?: GppWidgetConfig;
@@ -622,6 +637,7 @@ declare class ConsentiSetup implements ConsentiWidgetAPI {
     private initializing;
     private profile;
     private resolvedBase;
+    private profilePatches;
     /** cookieId → Category lookup, rebuilt whenever `profile` changes. Avoids rescanning categories on every consent action. */
     private categoryIndex;
     /** Watchers created by the declarative `data-consenti-*` DOM scan — destroyed alongside the widget since they have no other owner. */
@@ -677,6 +693,14 @@ declare class ConsentiSetup implements ConsentiWidgetAPI {
      * cookies per compliance group (built-in or custom) without authoring a separate profile for
      * each one. Applied before `profileOverride`, which still always wins as the final catch-all. */
     private applyComplianceGroupOverride;
+    /**
+     * Applied in order: compliance-group override → `config.profileOverride` → each `setProfile()`
+     * patch. The `setProfile()` patches are kept as a list and replayed, not folded into one
+     * object, because folding runs `deepMerge` patch-onto-patch, which consumes `null`/`'*': null`
+     * delete markers before they ever reach the profile they were meant to delete from.
+     */
+    private applyProfileOverrides;
+    private warnIfAcceptOnly;
     /**
      * Whether `window.__tcfapi`/`window.__gpp` should stay uninstalled because the corresponding
      * server-side registration (`compliance.tcf`/`compliance.gpp`) is unconfirmed (cmpId/cmpVersion

package/dist/react.d.ts

@@ -64,6 +64,10 @@ type ComplianceType = 'auto' | ComplianceGroupId | (string & {}) | Symbol;
 
 interface ComplianceMapData {
     version: string;
+    /** `true` (default): this map replaces the embedded one entirely, so only the countries listed here
+     * resolve (server side). `false`: `countries` is merged over the embedded map — a listed country
+     * replaces its embedded entry wholesale, every unlisted country keeps its built-in mapping. */
+    override?: boolean;
     countries: Record<string, CountryComplianceEntry>;
 }
 interface CountryComplianceEntry {
@@ -83,6 +87,9 @@ interface ConsentDbRecord {
     tenantId: string;
     visitorId: string;
     profileId: string;
+    /** The profile's `version` when this consent was last given — with `profileId`, pins the exact
+     * on-disk snapshot (the banner text the visitor saw). Absent on records from before it was tracked. */
+    profileVersion?: number;
     locale: string;
     consentJson: ConsentValue;
     gpcDetected: boolean;
@@ -281,7 +288,12 @@ interface ResolvedProfile {
     /** Apply WCAG 2.1 AA accessibility enhancements to the widget. */
     enhanceAccessibility?: boolean;
 }
-type WidgetCountryResolverFn = () => Promise<{
+type WidgetCountryResolverFn = (hints: {
+    timezone: string;
+    language: string;
+    languages: string[];
+    locale: string;
+}) => Promise<{
     country: string | null;
     region: string | null;
     confidence: number;
@@ -340,8 +352,11 @@ interface ComplianceWidgetConfig {
      * document from (the browser's own HTTP cache honors whatever `Cache-Control`/`ETag` the
      * response sends — no custom caching here), or an inline operator-supplied `ComplianceMapData`
      * object. Invalid data from either a URL or an object logs a warning and falls back to
-     * `'default'`. Only overrides the country→group mapping — country/region detection itself
-     * always uses the embedded geo data. */
+     * `'default'`. Only overrides the country→group mapping — country/region detection itself always
+     * uses the embedded geo data. A country the map doesn't list falls back to the embedded mapping
+     * unless the document sets `override: true` (then it gets the strictest group, `'opt-in'`).
+     * Unlike the server, an omitted `override` is NOT `true` here: widget maps have always merged
+     * over the embedded mapping, and that stays the default. */
     complianceMap?: 'default' | string | ComplianceMapData;
     tcf?: TcfWidgetConfig;
     gpp?: GppWidgetConfig;
@@ -622,6 +637,7 @@ declare class ConsentiSetup implements ConsentiWidgetAPI {
     private initializing;
     private profile;
     private resolvedBase;
+    private profilePatches;
     /** cookieId → Category lookup, rebuilt whenever `profile` changes. Avoids rescanning categories on every consent action. */
     private categoryIndex;
     /** Watchers created by the declarative `data-consenti-*` DOM scan — destroyed alongside the widget since they have no other owner. */
@@ -677,6 +693,14 @@ declare class ConsentiSetup implements ConsentiWidgetAPI {
      * cookies per compliance group (built-in or custom) without authoring a separate profile for
      * each one. Applied before `profileOverride`, which still always wins as the final catch-all. */
     private applyComplianceGroupOverride;
+    /**
+     * Applied in order: compliance-group override → `config.profileOverride` → each `setProfile()`
+     * patch. The `setProfile()` patches are kept as a list and replayed, not folded into one
+     * object, because folding runs `deepMerge` patch-onto-patch, which consumes `null`/`'*': null`
+     * delete markers before they ever reach the profile they were meant to delete from.
+     */
+    private applyProfileOverrides;
+    private warnIfAcceptOnly;
     /**
      * Whether `window.__tcfapi`/`window.__gpp` should stay uninstalled because the corresponding
      * server-side registration (`compliance.tcf`/`compliance.gpp`) is unconfirmed (cmpId/cmpVersion

package/dist/vue.d.cts

@@ -66,6 +66,10 @@ type ComplianceType = 'auto' | ComplianceGroupId | (string & {}) | Symbol;
 
 interface ComplianceMapData {
     version: string;
+    /** `true` (default): this map replaces the embedded one entirely, so only the countries listed here
+     * resolve (server side). `false`: `countries` is merged over the embedded map — a listed country
+     * replaces its embedded entry wholesale, every unlisted country keeps its built-in mapping. */
+    override?: boolean;
     countries: Record<string, CountryComplianceEntry>;
 }
 interface CountryComplianceEntry {
@@ -85,6 +89,9 @@ interface ConsentDbRecord {
     tenantId: string;
     visitorId: string;
     profileId: string;
+    /** The profile's `version` when this consent was last given — with `profileId`, pins the exact
+     * on-disk snapshot (the banner text the visitor saw). Absent on records from before it was tracked. */
+    profileVersion?: number;
     locale: string;
     consentJson: ConsentValue;
     gpcDetected: boolean;
@@ -283,7 +290,12 @@ interface ResolvedProfile {
     /** Apply WCAG 2.1 AA accessibility enhancements to the widget. */
     enhanceAccessibility?: boolean;
 }
-type WidgetCountryResolverFn = () => Promise<{
+type WidgetCountryResolverFn = (hints: {
+    timezone: string;
+    language: string;
+    languages: string[];
+    locale: string;
+}) => Promise<{
     country: string | null;
     region: string | null;
     confidence: number;
@@ -342,8 +354,11 @@ interface ComplianceWidgetConfig {
      * document from (the browser's own HTTP cache honors whatever `Cache-Control`/`ETag` the
      * response sends — no custom caching here), or an inline operator-supplied `ComplianceMapData`
      * object. Invalid data from either a URL or an object logs a warning and falls back to
-     * `'default'`. Only overrides the country→group mapping — country/region detection itself
-     * always uses the embedded geo data. */
+     * `'default'`. Only overrides the country→group mapping — country/region detection itself always
+     * uses the embedded geo data. A country the map doesn't list falls back to the embedded mapping
+     * unless the document sets `override: true` (then it gets the strictest group, `'opt-in'`).
+     * Unlike the server, an omitted `override` is NOT `true` here: widget maps have always merged
+     * over the embedded mapping, and that stays the default. */
     complianceMap?: 'default' | string | ComplianceMapData;
     tcf?: TcfWidgetConfig;
     gpp?: GppWidgetConfig;
@@ -624,6 +639,7 @@ declare class ConsentiSetup implements ConsentiWidgetAPI {
     private initializing;
     private profile;
     private resolvedBase;
+    private profilePatches;
     /** cookieId → Category lookup, rebuilt whenever `profile` changes. Avoids rescanning categories on every consent action. */
     private categoryIndex;
     /** Watchers created by the declarative `data-consenti-*` DOM scan — destroyed alongside the widget since they have no other owner. */
@@ -679,6 +695,14 @@ declare class ConsentiSetup implements ConsentiWidgetAPI {
      * cookies per compliance group (built-in or custom) without authoring a separate profile for
      * each one. Applied before `profileOverride`, which still always wins as the final catch-all. */
     private applyComplianceGroupOverride;
+    /**
+     * Applied in order: compliance-group override → `config.profileOverride` → each `setProfile()`
+     * patch. The `setProfile()` patches are kept as a list and replayed, not folded into one
+     * object, because folding runs `deepMerge` patch-onto-patch, which consumes `null`/`'*': null`
+     * delete markers before they ever reach the profile they were meant to delete from.
+     */
+    private applyProfileOverrides;
+    private warnIfAcceptOnly;
     /**
      * Whether `window.__tcfapi`/`window.__gpp` should stay uninstalled because the corresponding
      * server-side registration (`compliance.tcf`/`compliance.gpp`) is unconfirmed (cmpId/cmpVersion

package/dist/vue.d.ts

@@ -66,6 +66,10 @@ type ComplianceType = 'auto' | ComplianceGroupId | (string & {}) | Symbol;
 
 interface ComplianceMapData {
     version: string;
+    /** `true` (default): this map replaces the embedded one entirely, so only the countries listed here
+     * resolve (server side). `false`: `countries` is merged over the embedded map — a listed country
+     * replaces its embedded entry wholesale, every unlisted country keeps its built-in mapping. */
+    override?: boolean;
     countries: Record<string, CountryComplianceEntry>;
 }
 interface CountryComplianceEntry {
@@ -85,6 +89,9 @@ interface ConsentDbRecord {
     tenantId: string;
     visitorId: string;
     profileId: string;
+    /** The profile's `version` when this consent was last given — with `profileId`, pins the exact
+     * on-disk snapshot (the banner text the visitor saw). Absent on records from before it was tracked. */
+    profileVersion?: number;
     locale: string;
     consentJson: ConsentValue;
     gpcDetected: boolean;
@@ -283,7 +290,12 @@ interface ResolvedProfile {
     /** Apply WCAG 2.1 AA accessibility enhancements to the widget. */
     enhanceAccessibility?: boolean;
 }
-type WidgetCountryResolverFn = () => Promise<{
+type WidgetCountryResolverFn = (hints: {
+    timezone: string;
+    language: string;
+    languages: string[];
+    locale: string;
+}) => Promise<{
     country: string | null;
     region: string | null;
     confidence: number;
@@ -342,8 +354,11 @@ interface ComplianceWidgetConfig {
      * document from (the browser's own HTTP cache honors whatever `Cache-Control`/`ETag` the
      * response sends — no custom caching here), or an inline operator-supplied `ComplianceMapData`
      * object. Invalid data from either a URL or an object logs a warning and falls back to
-     * `'default'`. Only overrides the country→group mapping — country/region detection itself
-     * always uses the embedded geo data. */
+     * `'default'`. Only overrides the country→group mapping — country/region detection itself always
+     * uses the embedded geo data. A country the map doesn't list falls back to the embedded mapping
+     * unless the document sets `override: true` (then it gets the strictest group, `'opt-in'`).
+     * Unlike the server, an omitted `override` is NOT `true` here: widget maps have always merged
+     * over the embedded mapping, and that stays the default. */
     complianceMap?: 'default' | string | ComplianceMapData;
     tcf?: TcfWidgetConfig;
     gpp?: GppWidgetConfig;
@@ -624,6 +639,7 @@ declare class ConsentiSetup implements ConsentiWidgetAPI {
     private initializing;
     private profile;
     private resolvedBase;
+    private profilePatches;
     /** cookieId → Category lookup, rebuilt whenever `profile` changes. Avoids rescanning categories on every consent action. */
     private categoryIndex;
     /** Watchers created by the declarative `data-consenti-*` DOM scan — destroyed alongside the widget since they have no other owner. */
@@ -679,6 +695,14 @@ declare class ConsentiSetup implements ConsentiWidgetAPI {
      * cookies per compliance group (built-in or custom) without authoring a separate profile for
      * each one. Applied before `profileOverride`, which still always wins as the final catch-all. */
     private applyComplianceGroupOverride;
+    /**
+     * Applied in order: compliance-group override → `config.profileOverride` → each `setProfile()`
+     * patch. The `setProfile()` patches are kept as a list and replayed, not folded into one
+     * object, because folding runs `deepMerge` patch-onto-patch, which consumes `null`/`'*': null`
+     * delete markers before they ever reach the profile they were meant to delete from.
+     */
+    private applyProfileOverrides;
+    private warnIfAcceptOnly;
     /**
      * Whether `window.__tcfapi`/`window.__gpp` should stay uninstalled because the corresponding
      * server-side registration (`compliance.tcf`/`compliance.gpp`) is unconfirmed (cmpId/cmpVersion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@consenti/ui",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "GDPR-style cookie consent widget — zero required runtime dependencies",
   "license": "Apache-2.0",
   "author": {
@@ -81,14 +81,14 @@
   "devDependencies": {
     "@consenti/types": "*",
     "@consenti/utils": "*",
-    "@types/node": "^26.1.1",
-    "@types/react": "^19.0.0",
+    "@types/node": "^26.1.2",
+    "@types/react": "^19.2.18",
     "sass": "^1.102.0",
     "tsup": "^8.5.0",
     "tsx": "^4.23.0",
     "typescript": "^6.0.3",
     "vite": "^8.2.0",
-    "vue": "^3.5.40"
+    "vue": "^3.5.41"
   },
   "peerDependencies": {
     "react": ">=18.0.0",