@ecomconsult/consentkit 0.3.2 → 0.3.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/README.md +58 -3
  2. package/npm/core.cjs +1 -1
  3. package/npm/index.cjs +1 -1
  4. package/npm/internal-stub.mjs +1 -1
  5. package/package.json +4 -1
  6. package/src/ck-core.js +1 -1
  7. package/src/ck-saas.js +1 -1
package/README.md CHANGED
@@ -10,14 +10,19 @@ trackers *before* they run, a Shadow DOM banner, and Google Consent Mode v2.
10
10
 
11
11
  Most cookie banners are decoration — the trackers fire on the first frame no
12
12
  matter which button you press. ConsentKit blocks at parse time: nothing but
13
- `necessary` runs until the visitor says so, and no request leaves the page
14
- before that, including requests to a CDN or a font host.
13
+ `necessary` runs until the visitor says so. Dynamically injected trackers (the
14
+ official Metrika / GTM / Meta / TikTok / Hotjar snippets) and anything marked
15
+ `type="text/plain"` never fire a request; a plain `<script src>` tag written
16
+ into the HTML is prevented from executing and setting cookies, but its network
17
+ request may already be in flight — mark such tags up manually.
15
18
 
16
19
  Vanilla ES2020, zero dependencies, no build step.
17
20
 
18
21
  - **Categories:** `necessary` (always on), `functional`, `analytics`, `marketing`
19
22
  - **Blocking:** manual markup (`type="text/plain"`) plus automatic interception
20
- of dynamically injected scripts
23
+ of dynamically injected scripts. Plain `<script src>` tags written into the HTML
24
+ (e.g. a direct GA4 `gtag/js` tag) cannot be intercepted before the request
25
+ leaves — mark those up manually; the SaaS install check points at the exact tag
21
26
  - **UI:** banner (`bar` / `box` / `modal`), preferences panel, floating re-open
22
27
  button, light/dark, 30+ locales
23
28
  - **SSR-safe:** importing on the server never touches the DOM
@@ -310,6 +315,56 @@ The decision is stored in a `ck_consent` cookie (base64 JSON, `path=/`,
310
315
  discarded — and the banner shown again — when `policyVersion` changes or the TTL
311
316
  expires.
312
317
 
318
+ ## Branding
319
+
320
+ By default the banner shows a small "Made by E-COM Consult" attribution line,
321
+ linking to ecomconsult.net. It is emitted as a `branding` object in the config,
322
+ and the prebuilt blocks in `ready/` carry it.
323
+
324
+ Removing it is a supported, first-class option — no obligation, no nag:
325
+
326
+ ```sh
327
+ node tools/build-inline.mjs --langs=en,ru --no-branding # block without it
328
+ ```
329
+
330
+ If you write the config by hand, simply omit the `branding` object; nothing
331
+ renders without it. Either way costs you ~200 bytes, not a licence: the client
332
+ is MIT and the line is yours to drop.
333
+
334
+ Note that only the attribution line ships, not the logo — `brand/ecom-consult-logo.svg`
335
+ is a white wordmark authored for dark backgrounds, so it would be invisible on
336
+ the banner's light surface. Supply your own `branding.logo` (and `logoDark`) if
337
+ you want a mark; see the branding notes in `src/ck-ui.js`.
338
+
339
+ In the **hosted service** the line is on by default and switching it off is part
340
+ of the paid plans. To be clear about what is being charged for: the fee covers
341
+ hosting, the cabinet and the scanner — not the line itself.
342
+
343
+ ## Prebuilt inline blocks
344
+
345
+ For site builders that will not let you upload files, `ready/` holds
346
+ ready-to-paste `<script>` blocks — copy one wholesale into `<head>`. Zero
347
+ external requests. Rebuild them with `tools/build-inline.mjs` (see
348
+ [`tools/README.md`](tools/README.md)); each block's header records the exact
349
+ command that produced it.
350
+
351
+ ConsentKit 0.3.4, rebuilt 2026-09-04, uncompressed — gzip on the server cuts
352
+ this roughly three- to fourfold. Every block includes the attribution line;
353
+ `--no-branding` takes ~200 bytes back off:
354
+
355
+ | Block | Languages | Bytes |
356
+ |---|---|---|
357
+ | `ready/en-bar.txt` | en | 102,128 |
358
+ | `ready/ru-bar.txt` | ru, en | 102,191 |
359
+ | `ready/ru-box.txt` | ru, en | 102,206 |
360
+ | `ready/ru-box-right.txt` | ru, en | 102,215 |
361
+ | `ready/ru-modal.txt` | ru, en | 102,199 |
362
+ | `ready/eu-bar.txt` | 34 languages | 152,403 |
363
+
364
+ Size is driven almost entirely by the bundled languages: `en` and `ru` are
365
+ built into the UI and cost nothing extra, while layout, position, theme and
366
+ accent change only a few bytes of config.
367
+
313
368
  ## TypeScript
314
369
 
315
370
  Types ship with the package; no `@types` needed.
package/npm/core.cjs CHANGED
@@ -21,7 +21,7 @@ function undecidedState() {
21
21
 
22
22
  function createStub() {
23
23
  return {
24
- version: '0.2.0',
24
+ version: '0.3.4',
25
25
  config: {},
26
26
  init: function () { return undecidedState(); },
27
27
  allowed: function (cat) { return cat === 'necessary'; },
package/npm/index.cjs CHANGED
@@ -24,7 +24,7 @@ function undecidedState() {
24
24
 
25
25
  function createStub() {
26
26
  return {
27
- version: '0.2.0',
27
+ version: '0.3.4',
28
28
  config: {},
29
29
  init: function () { return undecidedState(); },
30
30
  allowed: function (cat) { return cat === 'necessary'; },
package/npm/internal-stub.mjs CHANGED
@@ -28,7 +28,7 @@ export function undecidedState() {
28
28
  */
29
29
  export function createStub() {
30
30
  const stub = {
31
- version: '0.2.0',
31
+ version: '0.3.4',
32
32
  config: {},
33
33
  init: function () { return undecidedState(); },
34
34
  allowed: function (cat) { return cat === 'necessary'; },
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@ecomconsult/consentkit",
3
- "version": "0.3.2",
3
+ "version": "0.3.4",
4
4
  "description": "GDPR cookie consent core with blocking engine, Shadow DOM UI and Google Consent Mode v2. Zero dependencies, no build step.",
5
5
  "repository": {
6
6
  "type": "git",
@@ -20,6 +20,9 @@
20
20
  ],
21
21
  "author": "E-COM CONSULT PLUS",
22
22
  "license": "MIT",
23
+ "scripts": {
24
+ "test": "node --test test/*.test.mjs"
25
+ },
23
26
  "type": "module",
24
27
  "sideEffects": true,
25
28
  "types": "./npm/index.d.ts",
package/src/ck-core.js CHANGED
@@ -961,7 +961,7 @@
961
961
  // Public API
962
962
  // ---------------------------------------------------------------------------
963
963
  var ConsentKit = {
964
- version: '0.3.2',
964
+ version: '0.3.4',
965
965
  config: config,
966
966
 
967
967
  init: function (userConfig) {
package/src/ck-saas.js CHANGED
@@ -18,7 +18,7 @@
18
18
  var doc = global.document;
19
19
  if (!doc) { return; }
20
20
 
21
- var DEFAULT_API = 'https://api.ecomconsult.net';
21
+ var DEFAULT_API = 'https://consent.ecomconsult.net';
22
22
  var CFG_TIMEOUT_MS = 3000;
23
23
  var RETRY_DELAY_MS = 2000;
24
24
  var CACHE_PREFIX = 'ck_cfg_';