npm - @ecomconsult/consentkit - Versions diffs - 0.3.3 → 0.3.5 - Mend

@ecomconsult/consentkit 0.3.3 → 0.3.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (8) hide show

package/README.md CHANGED Viewed

@@ -10,14 +10,19 @@ trackers *before* they run, a Shadow DOM banner, and Google Consent Mode v2.
 Most cookie banners are decoration — the trackers fire on the first frame no
 matter which button you press. ConsentKit blocks at parse time: nothing but
-`necessary` runs until the visitor says so, and no request leaves the page
-before that, including requests to a CDN or a font host.
+`necessary` runs until the visitor says so. Dynamically injected trackers (the
+official Metrika / GTM / Meta / TikTok / Hotjar snippets) and anything marked
+`type="text/plain"` never fire a request; a plain `<script src>` tag written
+into the HTML is prevented from executing and setting cookies, but its network
+request may already be in flight — mark such tags up manually.
 Vanilla ES2020, zero dependencies, no build step.
 - **Categories:** `necessary` (always on), `functional`, `analytics`, `marketing`
 - **Blocking:** manual markup (`type="text/plain"`) plus automatic interception
-  of dynamically injected scripts
+  of dynamically injected scripts. Plain `<script src>` tags written into the HTML
+  (e.g. a direct GA4 `gtag/js` tag) cannot be intercepted before the request
+  leaves — mark those up manually; the SaaS install check points at the exact tag
 - **UI:** banner (`bar` / `box` / `modal`), preferences panel, floating re-open
   button, light/dark, 30+ locales
 - **SSR-safe:** importing on the server never touches the DOM
@@ -310,6 +315,156 @@ The decision is stored in a `ck_consent` cookie (base64 JSON, `path=/`,
 discarded — and the banner shown again — when `policyVersion` changes or the TTL
 expires.
+## Branding
+By default the banner shows a small "Made by E-COM Consult" attribution line,
+linking to ecomconsult.net. It is emitted as a `branding` object in the config,
+and the prebuilt blocks in `ready/` carry it.
+Removing it is a supported, first-class option — no obligation, no nag:
+```sh
+node tools/build-inline.mjs --langs=en,ru --no-branding   # block without it
+```
+If you write the config by hand, simply omit the `branding` object; nothing
+renders without it. Either way costs you ~200 bytes, not a licence: the client
+is MIT and the line is yours to drop.
+Note that only the attribution line ships, not the logo — `brand/ecom-consult-logo.svg`
+is a white wordmark authored for dark backgrounds, so it would be invisible on
+the banner's light surface. Supply your own `branding.logo` (and `logoDark`) if
+you want a mark; see the branding notes in `src/ck-ui.js`.
+In the **hosted service** the line is on by default and switching it off is part
+of the paid plans. To be clear about what is being charged for: the fee covers
+hosting, the cabinet and the scanner — not the line itself.
+## Prebuilt inline blocks
+For site builders that will not let you upload files, `ready/` holds
+ready-to-paste `<script>` blocks — copy one wholesale into `<head>`. Zero
+external requests. Rebuild them with `tools/build-inline.mjs` (see
+[`tools/README.md`](tools/README.md)); each block's header records the exact
+command that produced it.
+ConsentKit 0.3.5, rebuilt 2026-09-04, uncompressed — gzip on the server cuts
+this roughly three- to fourfold. Every block includes the attribution line;
+`--no-branding` takes ~200 bytes back off:
+| Block | Languages | Bytes |
+|---|---|---|
+| `ready/en-bar.txt` | en | 111,664 |
+| `ready/ru-bar.txt` | ru, ro, en | 113,285 |
+| `ready/ru-box.txt` | ru, ro, en | 113,300 |
+| `ready/ru-box-right.txt` | ru, ro, en | 113,309 |
+| `ready/ru-modal.txt` | ru, ro, en | 113,293 |
+| `ready/eu-bar.txt` | 34 languages | 161,939 |
+Size is driven almost entirely by the bundled languages: `en` and `ru` are
+built into the UI and cost nothing extra, while layout, position, theme and
+accent change only a few bytes of config.
+The debug panel is **not** in these numbers. Blocks carry a ~5.1 KB loader
+(`src/ck-debug-loader.js`) which fetches the 33 KB panel only when someone opens
+the page with `?ck_debug=1` — see [Debug mode](#debug-mode). An ordinary visitor
+downloads the loader and nothing more.
+## Debug mode
+A panel that shows what the client actually did on a live page — useful when a
+site owner asks "is this thing working?" and screenshots of the banner do not
+answer it.
+**Open it** by adding `?ck_debug=1` to the page URL (`#ck_debug` works too):
+```
+https://example.com/?ck_debug=1
+```
+A dark, monospace panel appears bottom-right in its own Shadow DOM. The flag is
+remembered in `localStorage` for that browser, so it survives navigation.
+**It shows**, in order: the client version, config source (SaaS or inline),
+siteId and policy version / ETag; the consent status, granted categories,
+decision time and cookie lifetime; what the blocking engine is holding back
+(`ConsentKit._blocked()`); which requests to known trackers actually left the
+page, each marked *before* or *after* consent; the recent `ck_*` dataLayer
+events and `gtag('consent', …)` calls; and three buttons — reset consent
+(withdraw, clear the cookie, reload), open preferences, and copy a JSON report.
+The request list carries the same caveat as the blocking engine itself:
+requests that left **before** ck-core.js parsed — a plain `<script src>` written
+into the HTML — show up there but could not have been blocked. Mark those tags
+up manually.
+**Turn it off** with `?ck_debug=0`, or the × in the panel's header. The loader
+owns the stored flag, so `?ck_debug=0` clears it whether or not the panel is on
+the page.
+**Privacy.** Nothing is sent anywhere: the panel is local to that browser and
+that page. It never renders cookie *values* (names only) and never shows URL
+query strings (host and path only), so the copied report is safe to paste into
+a support ticket.
+### How the panel gets onto the page
+The panel is ~33 KB, and on any given page exactly one person will ever open
+it. So `ready/*.txt` and the WordPress plugin ship **`src/ck-debug-loader.js`**
+(~5.1 KB) instead, and the loader fetches the panel on demand. With no flag set
+the loader creates no DOM, installs no observers and makes **no network
+request** — it costs its own bytes and nothing else.
+When the panel *is* activated, the loader resolves its URL in this order, first
+match wins:
+1. **`window.ConsentKitDebugUrl`**, if you set it — a self-hosted copy, an
+   internal mirror, or a pinned build. Set it before the loader runs.
+2. **`<API_BASE>/client/ck-debug.js`**, when `ck-saas.js` is on the page with a
+   site id — `API_BASE` is that loader's `data-ck-api` (its `ConsentKit._saas.api`).
+   The panel then comes from the same origin as the config, so a locked-down CSP
+   needs no extra host. **A SaaS deployment is expected to serve the panel at
+   that path**; if yours does not, set `window.ConsentKitDebugUrl` instead.
+3. **jsDelivr**, pinned to the running core version:
+   `https://cdn.jsdelivr.net/npm/@ecomconsult/consentkit@<version>/src/ck-debug.js`.
+   The version comes from `ConsentKit.version`, so the panel can never be newer
+   or older than the client it is reporting on. This path is published because
+   `package.json` lists `src` in `files`.
+The script is injected `async`, and neither jsDelivr nor a ConsentKit API host
+is in the blocking engine's tracker list, so the panel loads even while the
+visitor has yet to decide.
+### Loading the panel directly
+If you host the files yourself and would rather have the panel inline, load it
+after `ck-ui.js` (and after `ck-saas.js` if you use it) and skip the loader:
+```html
+<script src="/js/ck-core.js"></script>
+<script src="/js/ck-locales.js"></script>
+<script src="/js/ck-ui.js"></script>
+<script src="/js/ck-debug.js"></script>
+```
+`ck-debug.js` is self-contained: it repeats the loader's activation check, so it
+works with or without the loader. Do **not** add it to a page that already ships
+the loader (an inline block from `ready/`, or the WordPress plugin) — the loader
+fetches the panel itself, and a second copy would mount a second panel.
+From npm it is a deliberate opt-in — `@ecomconsult/consentkit` does not pull
+it in for you. Import it yourself, after the UI:
+```js
+import '@ecomconsult/consentkit';           // core + locales + UI
+import '@ecomconsult/consentkit/src/ck-debug.js';
+```
+**Language.** The panel is Russian or English: it follows the banner's
+configured `language`, falls back to `navigator.language` (`ru-*` → Russian),
+and otherwise renders English. The JSON report it copies is language-neutral
+whichever way the panel reads.
 ## TypeScript
 Types ship with the package; no `@types` needed.

package/npm/core.cjs CHANGED Viewed

@@ -21,7 +21,7 @@ function undecidedState() {
 function createStub() {
   return {
-    version: '0.2.0',
+    version: '0.3.5',
     config: {},
     init: function () { return undecidedState(); },
     allowed: function (cat) { return cat === 'necessary'; },

package/npm/index.cjs CHANGED Viewed

@@ -24,7 +24,7 @@ function undecidedState() {
 function createStub() {
   return {
-    version: '0.2.0',
+    version: '0.3.5',
     config: {},
     init: function () { return undecidedState(); },
     allowed: function (cat) { return cat === 'necessary'; },

package/npm/internal-stub.mjs CHANGED Viewed

@@ -28,7 +28,7 @@ export function undecidedState() {
  */
 export function createStub() {
   const stub = {
-    version: '0.2.0',
+    version: '0.3.5',
     config: {},
     init: function () { return undecidedState(); },
     allowed: function (cat) { return cat === 'necessary'; },

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@ecomconsult/consentkit",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "description": "GDPR cookie consent core with blocking engine, Shadow DOM UI and Google Consent Mode v2. Zero dependencies, no build step.",
   "repository": {
     "type": "git",
@@ -20,6 +20,9 @@
   ],
   "author": "E-COM CONSULT PLUS",
   "license": "MIT",
+  "scripts": {
+    "test": "node --test test/*.test.mjs"
+  },
   "type": "module",
   "sideEffects": true,
   "types": "./npm/index.d.ts",

package/src/ck-core.js CHANGED Viewed

@@ -629,7 +629,62 @@
     return !allowed(cat);
   }
+  // Registry of everything the engine intercepted, for the debug panel (§8.1
+  // item 3). Kept deliberately small: host + path only, никаких query strings —
+  // a tracker URL's query carries ids and, on badly built sites, PII.
+  // Capped so a page that injects trackers in a loop cannot grow it without
+  // bound; the panel shows the first BLOCKED_MAX, which is always enough to see
+  // what is happening.
+  var BLOCKED_MAX = 200;
+  var blockedLog = [];
+  // host + path, query and fragment dropped.
+  function safeUrlParts(src) {
+    var host = '';
+    var path = '';
+    try {
+      var base = (global.location && global.location.href) || 'http://localhost/';
+      var u = new URL(String(src), base);
+      host = (u.hostname || '').toLowerCase();
+      path = u.pathname || '';
+    } catch (e) {
+      var s = String(src || '');
+      var m = /^(?:[a-z]+:)?\/\/([^/?#]+)([^?#]*)/i.exec(s);
+      if (m) {
+        host = m[1].toLowerCase().replace(/:\d+$/, '');
+        path = m[2] || '';
+      } else {
+        path = s.split('?')[0].split('#')[0];
+      }
+    }
+    return { host: host, path: path };
+  }
+  function noteBlocked(el, src, cat, origin) {
+    try {
+      if (blockedLog.length >= BLOCKED_MAX) { return; }
+      var kind = 'script';
+      try {
+        var tag = el && el.tagName ? String(el.tagName).toLowerCase() : '';
+        if (tag) { kind = tag === 'img' ? 'img' : tag; }
+      } catch (e2) { /* noop */ }
+      var parts = safeUrlParts(src);
+      for (var i = 0; i < blockedLog.length; i++) {
+        var p = blockedLog[i];
+        if (p.host === parts.host && p.path === parts.path && p.kind === kind) { return; }
+      }
+      blockedLog.push({
+        host: parts.host,
+        path: parts.path,
+        kind: kind,
+        category: cat || null,
+        origin: origin || 'engine'
+      });
+    } catch (e) { /* noop */ }
+  }
   function markBlocked(el, src, cat) {
+    noteBlocked(el, src, cat, 'engine');
     try {
       if (nativeSetAttribute) {
         nativeSetAttribute.call(el, 'data-ck-blocked', '1');
@@ -961,7 +1016,7 @@
   // Public API
   // ---------------------------------------------------------------------------
   var ConsentKit = {
-    version: '0.3.2',
+    version: '0.3.5',
     config: config,
     init: function (userConfig) {
@@ -1017,7 +1072,58 @@
     // Introspection helpers for the demo status panel (read-only).
     _categoryForUrl: categoryForUrl,
-    _categories: CATEGORIES.slice()
+    _categories: CATEGORIES.slice(),
+    // What is being held back until consent: everything the engine intercepted
+    // (origin 'engine') plus what the site author marked up by hand (origin
+    // 'markup'), which never goes through markBlocked. Read-only, host+path
+    // only — no query strings, so no ids and no PII. Used by src/ck-debug.js.
+    _blocked: function () {
+      var out = [];
+      var seen = {};
+      function add(rec) {
+        var key = rec.kind + '|' + rec.host + '|' + rec.path;
+        if (seen[key]) { return; }
+        seen[key] = 1;
+        out.push(rec);
+      }
+      try {
+        for (var i = 0; i < blockedLog.length; i++) {
+          var b = blockedLog[i];
+          // Interceptions are kept for the life of the page, but once the
+          // category is granted the element has been revived and is no longer
+          // held back — reporting it as still blocked would be false.
+          if (allowed(b.category)) { continue; }
+          add({ host: b.host, path: b.path, kind: b.kind, category: b.category, origin: b.origin });
+        }
+      } catch (e) { /* noop */ }
+      // Hand-marked tags still waiting for their category.
+      try {
+        // Only what applyConsentToDom() can actually revive. An img is never
+        // revived by the core, so listing hand-marked images here would show a
+        // pending state that never clears after the visitor accepts.
+        qsa('script[type="text/plain"][data-ck], iframe[data-ck][data-src]')
+          .forEach(function (el) {
+            try {
+              if (el.getAttribute('data-ck-restored')) { return; }
+              if (el.getAttribute('data-ck-blocked')) { return; } // already in the registry
+              var tag = String(el.tagName || '').toLowerCase();
+              if (tag === 'iframe' && el.getAttribute('src')) { return; }
+              var src = el.getAttribute('data-src') || el.getAttribute('data-ck-src') || '';
+              if (!src) { return; }
+              var cat = el.getAttribute('data-ck') || categoryForUrl(src);
+              if (allowed(cat)) { return; }
+              var parts = safeUrlParts(src);
+              add({
+                host: parts.host, path: parts.path,
+                kind: tag === 'iframe' ? 'iframe' : 'script',
+                category: cat || null, origin: 'markup'
+              });
+            } catch (e2) { /* noop */ }
+          });
+      } catch (e3) { /* noop */ }
+      return out;
+    }
   };
   // ---------------------------------------------------------------------------

package/src/ck-debug-loader.js ADDED Viewed

@@ -0,0 +1,134 @@
+/*!
+ * ConsentKit debug loader — the activation switch for the debug panel.
+ *
+ * The panel itself (src/ck-debug.js) is ~30 KB and useful to exactly one
+ * person on the page: the site owner, once, while diagnosing something. This
+ * loader ships instead of it in the inline blocks and in the WordPress plugin,
+ * and fetches the panel only when the visitor asks for it. Without activation
+ * it creates no DOM, installs no observers and makes no network request.
+ *
+ * Activation (?ck_debug=1 / #ck_debug / localStorage) and the three-step
+ * resolution order for the panel URL are documented in README «Debug mode».
+ * Two things are worth knowing while reading this file:
+ *
+ *   - The off switch has to work even though the panel is not loaded, so the
+ *     loader — not the panel — owns the stored flag. ck-debug.js keeps its own
+ *     identical copy of parseActivation() because it is loaded directly on our
+ *     demo page and must stay self-contained; writing the flag twice is
+ *     idempotent, and test/debug-loader.test.mjs asserts the two agree.
+ *   - Nothing here runs before activation. No DOM, no request, no observers.
+ *
+ * Load order: ck-core.js -> ck-locales.js -> ck-ui.js -> [ck-saas.js] -> this.
+ *
+ * Copyright (c) 2026 E-COM CONSULT PLUS. MIT License — see LICENSE.
+ */
+(function (global) {
+  'use strict';
+  if (!global || typeof global !== 'object') { return; }
+  var LS_KEY = 'ck_debug';
+  var CDN = 'https://cdn.jsdelivr.net/npm/@ecomconsult/consentkit@';
+  function isOffValue(v) {
+    return v === '0' || v === 'false' || v === 'no' || v === '';
+  }
+  // Identical to src/ck-debug.js parseActivation(). Pure: no DOM, no storage.
+  function parseActivation(search, hash, stored) {
+    var on = null;
+    var q = String(search || '');
+    if (q.charAt(0) === '?') { q = q.slice(1); }
+    var pairs = q ? q.split('&') : [];
+    for (var i = 0; i < pairs.length; i++) {
+      var eq = pairs[i].indexOf('=');
+      var k = eq === -1 ? pairs[i] : pairs[i].slice(0, eq);
+      if (k !== LS_KEY) { continue; }
+      on = eq === -1 ? true : !isOffValue(pairs[i].slice(eq + 1));
+    }
+    if (on === null) {
+      var h = String(hash || '');
+      if (h.charAt(0) === '#') { h = h.slice(1); }
+      if (h === LS_KEY) { on = true; }
+      else if (h.indexOf(LS_KEY + '=') === 0) { on = !isOffValue(h.slice(LS_KEY.length + 1)); }
+    }
+    if (on === null) {
+      return { active: String(stored || '') === '1', persist: null };
+    }
+    return { active: on, persist: on ? 'on' : 'off' };
+  }
+  // Pure: takes what the page happens to expose, returns the URL to load.
+  // `explicit` is window.ConsentKitDebugUrl, `saas` is ConsentKit._saas.
+  // Order: explicit URL -> SaaS API origin -> jsDelivr pinned to the running
+  // core version. See README «Debug mode».
+  function resolveUrl(explicit, saas, version) {
+    var pinned = String(explicit || '').trim();
+    if (pinned) { return pinned; }
+    if (saas && saas.siteId && saas.api) {
+      var base = String(saas.api).replace(/\/+$/, '');
+      if (base) { return base + '/client/ck-debug.js'; }
+    }
+    return CDN + encodeURIComponent(String(version || 'latest')) + '/src/ck-debug.js';
+  }
+  var API = {
+    parseActivation: parseActivation,
+    resolveUrl: resolveUrl,
+    active: false,
+    url: null
+  };
+  try {
+    if (global.ConsentKit) { global.ConsentKit._debugLoader = API; }
+    global.__ckDebugLoader = API;
+  } catch (e) { /* noop */ }
+  function lsGet(k) {
+    try { return global.localStorage ? global.localStorage.getItem(k) : null; } catch (e) { return null; }
+  }
+  function lsSet(k, v) {
+    try { if (global.localStorage) { global.localStorage.setItem(k, v); } } catch (e) { /* noop */ }
+  }
+  function lsDel(k) {
+    try { if (global.localStorage) { global.localStorage.removeItem(k); } } catch (e) { /* noop */ }
+  }
+  var loc = global.location;
+  var act = parseActivation(loc && loc.search, loc && loc.hash, lsGet(LS_KEY));
+  // Persist BEFORE the early return: ?ck_debug=0 has to clear the stored flag
+  // even though nothing is loaded afterwards, or the panel could never be
+  // switched off again once it had been switched on.
+  if (act.persist === 'on') { lsSet(LS_KEY, '1'); }
+  if (act.persist === 'off') { lsDel(LS_KEY); }
+  if (!act.active) { return; }
+  var doc = global.document;
+  if (!doc || typeof doc.createElement !== 'function') { return; }
+  // Already loaded (the panel published its surface, or this ran twice).
+  if (global.__ckDebug) { API.active = true; return; }
+  var CK = global.ConsentKit;
+  var url = resolveUrl(
+    global.ConsentKitDebugUrl,
+    CK && CK._saas,
+    (CK && CK.version) || ''
+  );
+  API.active = true;
+  API.url = url;
+  try {
+    var s = doc.createElement('script');
+    s.src = url;
+    s.async = true;
+    // No opt-out attribute is needed: the blocking engine matches a fixed list
+    // of tracker hosts, and neither jsDelivr nor a ConsentKit API host is on
+    // it — test/debug-loader.test.mjs asserts that.
+    (doc.head || doc.body || doc.documentElement).appendChild(s);
+  } catch (e) { /* noop */ }
+})(typeof window !== 'undefined' ? window : (typeof globalThis !== 'undefined' ? globalThis : this));

package/src/ck-debug.js ADDED Viewed

@@ -0,0 +1,847 @@
+/*!
+ * ConsentKit debug panel (opt-in) — shows what the banner actually did on this
+ * page. Off by default: without activation this file creates no DOM, installs
+ * no observers and touches nothing.
+ *
+ * Activation (this browser only, nothing is sent anywhere):
+ *   ?ck_debug=1  or  #ck_debug   — turns it on and remembers it (localStorage)
+ *   ?ck_debug=0                  — turns it off and forgets it
+ *   localStorage.ck_debug = '1'  — same as the query parameter
+ *
+ * Load order: ck-core.js -> ck-locales.js -> ck-ui.js -> [ck-saas.js] -> ck-debug.js
+ *
+ * Copyright (c) 2026 E-COM CONSULT PLUS. MIT License — see LICENSE.
+ */
+(function (global) {
+  'use strict';
+  if (!global || typeof global !== 'object') { return; }
+  var LS_KEY = 'ck_debug';
+  // ---------------------------------------------------------------------------
+  // Activation (pure, testable: no DOM, no storage)
+  // ---------------------------------------------------------------------------
+  // Returns { active, persist } where persist is 'on' | 'off' | null:
+  // the query/hash form is sticky so the panel survives navigation, the bare
+  // localStorage form changes nothing.
+  function isOffValue(v) {
+    return v === '0' || v === 'false' || v === 'no' || v === '';
+  }
+  function parseActivation(search, hash, stored) {
+    var on = null;
+    var q = String(search || '');
+    if (q.charAt(0) === '?') { q = q.slice(1); }
+    var pairs = q ? q.split('&') : [];
+    for (var i = 0; i < pairs.length; i++) {
+      var eq = pairs[i].indexOf('=');
+      var k = eq === -1 ? pairs[i] : pairs[i].slice(0, eq);
+      if (k !== LS_KEY) { continue; }
+      // ?ck_debug (no "="), ?ck_debug=1, =true, =yes -> on
+      // ?ck_debug=0, =false, =no, =(empty) -> off. The empty value is treated
+      // as off deliberately: a form or a link builder that drops the value is
+      // far more likely to mean "not set" than "switch the panel on".
+      on = eq === -1 ? true : !isOffValue(pairs[i].slice(eq + 1));
+    }
+    if (on === null) {
+      var h = String(hash || '');
+      if (h.charAt(0) === '#') { h = h.slice(1); }
+      // #ck_debug or #ck_debug=1 (a plain fragment id, not a query)
+      if (h === LS_KEY) { on = true; }
+      else if (h.indexOf(LS_KEY + '=') === 0) { on = !isOffValue(h.slice(LS_KEY.length + 1)); }
+    }
+    if (on === null) {
+      return { active: String(stored || '') === '1', persist: null };
+    }
+    return { active: on, persist: on ? 'on' : 'off' };
+  }
+  // ---------------------------------------------------------------------------
+  // Report (pure, testable: takes plain data, returns plain data)
+  // ---------------------------------------------------------------------------
+  // No PII by construction: cookie names only (never values), host + path only
+  // (never query strings — tracker URLs carry ids there).
+  function stripUrl(url) {
+    var s = String(url || '');
+    var host = '';
+    var path = '';
+    var m = /^(?:[a-z]+:)?\/\/([^/?#]+)([^?#]*)/i.exec(s);
+    if (m) {
+      host = m[1].toLowerCase().replace(/:\d+$/, '');
+      path = m[2] || '';
+    } else {
+      path = s.split('?')[0].split('#')[0];
+    }
+    return { host: host, path: path };
+  }
+  // entries: PerformanceResourceTiming-like [{ name, startTime, initiatorType }]
+  // consentAtMs: performance-clock ms of the decision, or null when undecided
+  // classify: url -> category | null (ConsentKit._categoryForUrl)
+  function buildRequests(entries, consentAtMs, classify) {
+    var out = [];
+    var list = entries || [];
+    var seen = {};
+    for (var i = 0; i < list.length; i++) {
+      var e = list[i];
+      if (!e || !e.name) { continue; }
+      var cat = null;
+      try { cat = classify ? classify(e.name) : null; } catch (err) { cat = null; }
+      if (!cat) { continue; }                       // only known trackers
+      var p = stripUrl(e.name);
+      var t = Number(e.startTime) || 0;
+      var when = consentAtMs === null || consentAtMs === undefined
+        ? 'before' : (t >= consentAtMs ? 'after' : 'before');
+      var key = p.host + '|' + p.path + '|' + when;
+      if (seen[key]) { seen[key].count++; continue; }
+      var rec = {
+        host: p.host, path: p.path, category: cat, when: when,
+        at: Math.round(t), kind: String((e && e.initiatorType) || ''), count: 1
+      };
+      seen[key] = rec;
+      out.push(rec);
+    }
+    return out;
+  }
+  function buildReport(input) {
+    var d = input || {};
+    var st = d.state || {};
+    var cats = st.categories || {};
+    return {
+      generatedAt: d.now || null,
+      client: {
+        version: d.version || null,
+        source: d.siteId ? 'saas' : 'inline',
+        siteId: d.siteId || null,
+        policyVersion: st.policyVersion || (d.config && d.config.policyVersion) || null,
+        etag: d.etag || null
+      },
+      consent: {
+        status: !st.decided ? 'none'
+          : (cats.functional && cats.analytics && cats.marketing) ? 'accepted'
+          : (!cats.functional && !cats.analytics && !cats.marketing) ? 'rejected'
+          : 'partial',
+        categories: {
+          necessary: true,
+          functional: !!cats.functional,
+          analytics: !!cats.analytics,
+          marketing: !!cats.marketing
+        },
+        decidedAt: st.ts || null,
+        method: st.method || null,
+        ttlDays: d.ttlDays == null ? null : Number(d.ttlDays)
+      },
+      blocked: (d.blocked || []).map(function (b) {
+        return { host: b.host, path: b.path, kind: b.kind, category: b.category, origin: b.origin };
+      }),
+      requests: buildRequests(d.entries, d.consentAtMs, d.classify),
+      consentMode: (d.consentMode || []).slice(),
+      // Names only — a consent debug panel must never leak cookie contents.
+      cookieNames: (d.cookieNames || []).slice(),
+      note: NOTE_EN
+    };
+  }
+  var NOTE_RU = 'Запросы, ушедшие до загрузки ConsentKit (обычный <script src> ' +
+    'в разметке), видны в этом списке, но заблокировать их клиент не может — ' +
+    'такие теги размечают вручную.';
+  var NOTE_EN = 'Requests that left before ConsentKit loaded (a plain <script src> ' +
+    'written into the HTML) show up here but cannot be blocked — mark such tags up manually.';
+  // ---------------------------------------------------------------------------
+  // Panel language (pure; the JSON report stays language-neutral either way)
+  // ---------------------------------------------------------------------------
+  // The panel is read by whoever is debugging the site, so it follows the same
+  // language the banner resolved for this visitor rather than a build flag.
+  // Only ru and en exist: this is an internal diagnostic surface, and a
+  // half-translated one is worse than an English one.
+  var STRINGS = {
+    ru: {
+      regionLabel: 'ConsentKit — режим отладки',
+      collapse: 'Свернуть',
+      expand: 'Развернуть',
+      closeLabel: 'Закрыть и выключить режим отладки',
+      secClient: 'Клиент',
+      version: 'версия',
+      source: 'источник',
+      srcSaas: 'SaaS',
+      srcInline: 'инлайн',
+      secConsent: 'Согласие',
+      decidedAt: 'решение',
+      method: 'способ',
+      ttl: 'срок cookie',
+      days: ' дн.',
+      status: { none: 'нет решения', accepted: 'принято', rejected: 'отклонено', partial: 'частично' },
+      secBlocked: 'Заблокировано до согласия',
+      noBlocked: 'ничего не перехвачено',
+      markup: ' (разметка)',
+      secRequests: 'Запросы к трекерам',
+      noRequests: 'запросов к известным трекерам не было',
+      after: 'после согласия',
+      before: 'до согласия',
+      ms: ' мс',
+      note: NOTE_RU,
+      secConsentMode: 'Consent Mode / dataLayer',
+      noEvents: 'событий не было',
+      secActions: 'Действия',
+      reset: 'Сбросить согласие',
+      showPrefs: 'Показать настройки',
+      copy: 'Скопировать отчёт',
+      copied: 'Скопировано',
+      copyFailed: 'Не вышло',
+      footer: 'Панель видна только в этом браузере. Выключить: добавьте ?ck_debug=0 к адресу.'
+    },
+    en: {
+      regionLabel: 'ConsentKit — debug mode',
+      collapse: 'Collapse',
+      expand: 'Expand',
+      closeLabel: 'Close and turn debug mode off',
+      secClient: 'Client',
+      version: 'version',
+      source: 'source',
+      srcSaas: 'SaaS',
+      srcInline: 'inline',
+      secConsent: 'Consent',
+      decidedAt: 'decided',
+      method: 'method',
+      ttl: 'cookie lifetime',
+      days: ' days',
+      status: { none: 'no decision', accepted: 'accepted', rejected: 'rejected', partial: 'partial' },
+      secBlocked: 'Blocked until consent',
+      noBlocked: 'nothing intercepted',
+      markup: ' (markup)',
+      secRequests: 'Tracker requests',
+      noRequests: 'no requests to known trackers',
+      after: 'after consent',
+      before: 'before consent',
+      ms: ' ms',
+      note: NOTE_EN,
+      secConsentMode: 'Consent Mode / dataLayer',
+      noEvents: 'no events',
+      secActions: 'Actions',
+      reset: 'Reset consent',
+      showPrefs: 'Show preferences',
+      copy: 'Copy report',
+      copied: 'Copied',
+      copyFailed: 'Failed',
+      footer: 'This panel is visible in this browser only. To turn it off, add ?ck_debug=0 to the URL.'
+    }
+  };
+  // banner language (ConsentKit config) -> navigator.language -> en.
+  // `cfgLang` is ConsentKit.config.language, which may be 'auto'.
+  function pickLang(cfgLang, navLang) {
+    var raw = String(cfgLang || '').toLowerCase();
+    if (!raw || raw === 'auto') { raw = String(navLang || '').toLowerCase(); }
+    return raw.slice(0, 2) === 'ru' ? 'ru' : 'en';
+  }
+  // Testable surface. Published before the activation check so the inactive
+  // path is testable too; it is not a public API.
+  var API = {
+    parseActivation: parseActivation,
+    buildReport: buildReport,
+    buildRequests: buildRequests,
+    stripUrl: stripUrl,
+    pickLang: pickLang,
+    strings: STRINGS,
+    active: false
+  };
+  try {
+    if (global.ConsentKit) { global.ConsentKit._debug = API; }
+    global.__ckDebug = API;
+  } catch (e) { /* noop */ }
+  // ---------------------------------------------------------------------------
+  // Everything below runs only when activated.
+  // ---------------------------------------------------------------------------
+  var doc = global.document;
+  var loc = global.location;
+  function lsGet(k) {
+    try { return global.localStorage ? global.localStorage.getItem(k) : null; } catch (e) { return null; }
+  }
+  function lsSet(k, v) {
+    try { if (global.localStorage) { global.localStorage.setItem(k, v); } } catch (e) { /* noop */ }
+  }
+  function lsDel(k) {
+    try { if (global.localStorage) { global.localStorage.removeItem(k); } } catch (e) { /* noop */ }
+  }
+  var act = parseActivation(loc && loc.search, loc && loc.hash, lsGet(LS_KEY));
+  if (act.persist === 'on') { lsSet(LS_KEY, '1'); }
+  if (act.persist === 'off') { lsDel(LS_KEY); }
+  if (!act.active) { return; }
+  if (!doc || typeof doc.createElement !== 'function') { return; }
+  API.active = true;
+  var CK = global.ConsentKit;
+  // ---------------------------------------------------------------------------
+  // Observation (installed only when active)
+  // ---------------------------------------------------------------------------
+  var resources = [];
+  var consentAtMs = null;          // performance clock, set when consent is given
+  var consentMode = [];            // last ck_* dataLayer events and gtag consent calls
+  var CM_MAX = 20;
+  function nowMs() {
+    try {
+      if (global.performance && typeof global.performance.now === 'function') {
+        return global.performance.now();
+      }
+    } catch (e) { /* noop */ }
+    return 0;
+  }
+  // A decision restored from a previous page load happened before this page
+  // started, so every request on this load counts as "after".
+  function seedConsentTime() {
+    try {
+      var st = CK && CK.getState ? CK.getState() : null;
+      if (st && st.decided && consentAtMs === null) { consentAtMs = 0; }
+    } catch (e) { /* noop */ }
+  }
+  // Stamp the moment the visitor decides, BEFORE the core acts on it.
+  //
+  // This cannot wait for ck:change: accept() revives the blocked scripts
+  // synchronously and dispatches ck:change afterwards, so by the time the event
+  // fires those scripts have already issued their requests. Stamping on the
+  // event would then place them *before* the cutoff and the panel would report
+  // "до согласия" for the very requests the consent just released — exactly
+  // backwards, and on the one line an owner reads most carefully.
+  //
+  // Wrapping is observe-only: the original method is called with the original
+  // arguments and its return value passed straight back.
+  function stampOnDecision() {
+    try {
+      if (!CK) { return; }
+      ['accept', 'rejectAll'].forEach(function (name) {
+        var orig = CK[name];
+        if (typeof orig !== 'function' || orig.__ckDebugWrapped) { return; }
+        var wrapped = function () {
+          try { consentAtMs = nowMs(); } catch (e) { /* noop */ }
+          return orig.apply(CK, arguments);
+        };
+        wrapped.__ckDebugWrapped = true;
+        CK[name] = wrapped;
+      });
+      // withdraw() puts the page back to "no decision yet".
+      var w = CK.withdraw;
+      if (typeof w === 'function' && !w.__ckDebugWrapped) {
+        var wrappedW = function () {
+          try { consentAtMs = null; } catch (e) { /* noop */ }
+          return w.apply(CK, arguments);
+        };
+        wrappedW.__ckDebugWrapped = true;
+        CK.withdraw = wrappedW;
+      }
+    } catch (e) { /* noop */ }
+  }
+  function collectResources() {
+    try {
+      var perf = global.performance;
+      if (!perf) { return; }
+      if (typeof perf.getEntriesByType === 'function') {
+        var buffered = perf.getEntriesByType('resource') || [];
+        for (var i = 0; i < buffered.length; i++) { resources.push(buffered[i]); }
+      }
+      if (typeof global.PerformanceObserver === 'function') {
+        var po = new global.PerformanceObserver(function (list) {
+          try {
+            var got = list.getEntries() || [];
+            for (var j = 0; j < got.length; j++) { resources.push(got[j]); }
+            schedule();
+          } catch (e2) { /* noop */ }
+        });
+        // buffered:true re-delivers what happened before we attached; harmless
+        // duplicates are deduped when the list is rendered.
+        try { po.observe({ type: 'resource', buffered: true }); }
+        catch (e3) { try { po.observe({ entryTypes: ['resource'] }); } catch (e4) { /* noop */ } }
+      }
+    } catch (e) { /* noop */ }
+  }
+  // Observe only: the existing dataLayer.push is called first and its return
+  // value passed through, so a GTM/other wrapper keeps working.
+  function watchDataLayer() {
+    try {
+      var dl = global.dataLayer;
+      if (!dl) { global.dataLayer = dl = []; }
+      if (typeof dl.push !== 'function' || dl.__ckDebugWatched) { return; }
+      // Whatever is already in the queue counts too.
+      for (var i = 0; i < dl.length; i++) { noteDataLayer(dl[i]); }
+      var prev = dl.push;
+      dl.push = function () {
+        try {
+          for (var j = 0; j < arguments.length; j++) { noteDataLayer(arguments[j]); }
+        } catch (e) { /* never break the host page */ }
+        return prev.apply(this, arguments);
+      };
+      dl.__ckDebugWatched = true;
+    } catch (e) { /* noop */ }
+  }
+  function noteDataLayer(arg) {
+    try {
+      var rec = null;
+      // gtag() pushes an arguments object: ['consent', 'default'|'update', {...}]
+      if (arg && typeof arg === 'object' && typeof arg.length === 'number' && arg[0] === 'consent') {
+        var signals = {};
+        var payload = arg[2];
+        if (payload && typeof payload === 'object') {
+          for (var k in payload) {
+            if (Object.prototype.hasOwnProperty.call(payload, k)) { signals[k] = payload[k]; }
+          }
+        }
+        rec = { type: 'gtag consent ' + String(arg[1] || ''), signals: signals, at: Math.round(nowMs()) };
+      } else if (arg && typeof arg === 'object' && typeof arg.event === 'string' &&
+                 arg.event.indexOf('ck_') === 0) {
+        rec = { type: arg.event, signals: null, at: Math.round(nowMs()) };
+      }
+      if (!rec) { return; }
+      consentMode.push(rec);
+      if (consentMode.length > CM_MAX) { consentMode.shift(); }
+      schedule();
+    } catch (e) { /* noop */ }
+  }
+  function cookieNames() {
+    var names = [];
+    try {
+      var raw = typeof doc.cookie === 'string' ? doc.cookie : '';
+      var parts = raw.split(';');
+      for (var i = 0; i < parts.length; i++) {
+        var t = parts[i].trim();
+        if (!t) { continue; }
+        var eq = t.indexOf('=');
+        names.push(eq === -1 ? t : t.slice(0, eq));   // name only, never the value
+      }
+    } catch (e) { /* noop */ }
+    return names;
+  }
+  function saasInfo() {
+    var out = { siteId: null, etag: null };
+    try {
+      if (CK && CK._saas) {
+        out.siteId = CK._saas.siteId || null;
+        var cached = null;
+        try {
+          var raw = lsGet('ck_cfg_' + out.siteId);
+          cached = raw ? JSON.parse(raw) : null;
+        } catch (e2) { cached = null; }
+        out.etag = cached && cached.etag ? cached.etag : null;
+      }
+    } catch (e) { /* noop */ }
+    return out;
+  }
+  function reportInput() {
+    var s = saasInfo();
+    var cfg = (CK && CK.config) || {};
+    return {
+      now: new Date().toISOString(),
+      version: CK ? CK.version : null,
+      state: CK && CK.getState ? CK.getState() : {},
+      config: cfg,
+      siteId: s.siteId,
+      etag: s.etag,
+      ttlDays: cfg.consentTtlDays == null ? null : cfg.consentTtlDays,
+      blocked: (CK && typeof CK._blocked === 'function') ? CK._blocked() : [],
+      entries: resources,
+      consentAtMs: consentAtMs,
+      classify: CK ? CK._categoryForUrl : null,
+      consentMode: consentMode,
+      cookieNames: cookieNames()
+    };
+  }
+  // ---------------------------------------------------------------------------
+  // Panel (own Shadow DOM host, own styles)
+  // ---------------------------------------------------------------------------
+  var CSS = [
+    ':host{all:initial;position:fixed;right:12px;bottom:12px;z-index:2147483646;',
+    'font:12px/1.45 ui-monospace,SFMono-Regular,Menlo,Consolas,"Liberation Mono",monospace}',
+    '*{box-sizing:border-box}',
+    '.w{width:min(360px,calc(100vw - 24px));background:#12151c;color:#dfe3ea;',
+    'border:1px solid #2b3040;border-radius:8px;box-shadow:0 6px 24px rgba(0,0,0,.4);overflow:hidden}',
+    '.hd{display:flex;align-items:center;gap:8px;padding:7px 9px;background:#1a1f2a;',
+    'border-bottom:1px solid #2b3040}',
+    '.hd b{font-weight:600;color:#fff;font-size:12px}',
+    '.hd .sp{flex:1}',
+    'button{font:inherit;color:#dfe3ea;background:#232936;border:1px solid #39415400;',
+    'border-color:#394154;border-radius:5px;padding:3px 8px;cursor:pointer}',
+    'button:hover{background:#2c3444}',
+    'button:focus-visible{outline:2px solid #7aa2ff;outline-offset:1px}',
+    '.bd{max-height:min(60vh,460px);overflow:auto;padding:2px 9px 9px}',
+    '.bd[hidden]{display:none}',
+    'section{border-top:1px solid #232936;padding:7px 0}',
+    'section:first-child{border-top:0}',
+    'h2{margin:0 0 4px;font-size:11px;font-weight:600;color:#8d96ab;text-transform:uppercase;',
+    'letter-spacing:.04em}',
+    'dl{margin:0;display:grid;grid-template-columns:auto 1fr;gap:1px 8px}',
+    'dt{color:#8d96ab}',
+    'dd{margin:0;overflow-wrap:anywhere}',
+    'ul{margin:0;padding:0;list-style:none}',
+    'li{padding:2px 0;border-top:1px dotted #262c3a;overflow-wrap:anywhere}',
+    'li:first-child{border-top:0}',
+    '.t{display:inline-block;padding:0 5px;border-radius:3px;font-size:10px;',
+    'background:#2a3142;color:#a9b3c9;margin-right:4px}',
+    '.t.on{background:#173a24;color:#7ee2a0}',
+    '.t.off{background:#3a1a1d;color:#ff9aa2}',
+    '.mut{color:#8d96ab}',
+    '.note{margin:6px 0 0;color:#8d96ab;font-size:11px;line-height:1.4}',
+    '.row{display:flex;gap:6px;flex-wrap:wrap;margin-top:8px}',
+    '@media (prefers-reduced-motion:no-preference){button{transition:background-color .12s ease}}'
+  ].join('');
+  var host = null, root = null, body = null, toggleBtn = null, collapsed = false;
+  var frame = 0;
+  function el(tag, attrs, text) {
+    var n = doc.createElement(tag);
+    if (attrs) {
+      for (var k in attrs) {
+        if (Object.prototype.hasOwnProperty.call(attrs, k)) { n.setAttribute(k, attrs[k]); }
+      }
+    }
+    if (text != null) { n.textContent = String(text); }
+    return n;
+  }
+  function section(title) {
+    var s = doc.createElement('section');
+    s.appendChild(el('h2', null, title));
+    return s;
+  }
+  function defs(pairs) {
+    var dl = doc.createElement('dl');
+    for (var i = 0; i < pairs.length; i++) {
+      dl.appendChild(el('dt', null, pairs[i][0]));
+      dl.appendChild(el('dd', null, pairs[i][1] == null || pairs[i][1] === '' ? '—' : pairs[i][1]));
+    }
+    return dl;
+  }
+  function tag(text, cls) { return el('span', { class: 't' + (cls ? ' ' + cls : '') }, text); }
+  // Resolved lazily, not at parse time: this file runs before ConsentKit.init()
+  // has merged the site's config, so asking for the language now would always
+  // read the built-in default. Re-resolved on every render so a page that
+  // switches language at runtime switches the panel too.
+  var T = STRINGS.en;
+  function refreshLang() {
+    var nav = global.navigator;
+    T = STRINGS[pickLang(
+      (CK && CK.config && CK.config.language) || '',
+      (nav && (nav.language || nav.userLanguage)) || ''
+    )] || STRINGS.en;
+    return T;
+  }
+  function render() {
+    if (!body) { return; }
+    refreshLang();
+    var r = buildReport(reportInput());
+    body.textContent = '';
+    // 1. Client
+    var s1 = section(T.secClient);
+    s1.appendChild(defs([
+      [T.version, r.client.version],
+      [T.source, r.client.source === 'saas' ? T.srcSaas : T.srcInline],
+      ['siteId', r.client.siteId],
+      ['policyVersion', r.client.policyVersion],
+      ['ETag', r.client.etag]
+    ]));
+    body.appendChild(s1);
+    // 2. Consent
+    var s2 = section(T.secConsent);
+    var line = el('div');
+    line.appendChild(tag(T.status[r.consent.status] || r.consent.status,
+      r.consent.status === 'accepted' ? 'on' : r.consent.status === 'rejected' ? 'off' : ''));
+    s2.appendChild(line);
+    var cl = doc.createElement('div');
+    ['necessary', 'functional', 'analytics', 'marketing'].forEach(function (c) {
+      cl.appendChild(tag((r.consent.categories[c] ? '✓ ' : '✗ ') + c,
+        r.consent.categories[c] ? 'on' : 'off'));
+    });
+    s2.appendChild(cl);
+    s2.appendChild(defs([
+      [T.decidedAt, r.consent.decidedAt],
+      [T.method, r.consent.method],
+      [T.ttl, r.consent.ttlDays == null ? null : r.consent.ttlDays + T.days]
+    ]));
+    body.appendChild(s2);
+    // 3. Blocked until consent
+    var s3 = section(T.secBlocked + ' (' + r.blocked.length + ')');
+    if (!r.blocked.length) {
+      s3.appendChild(el('div', { class: 'mut' }, T.noBlocked));
+    } else {
+      var u3 = doc.createElement('ul');
+      r.blocked.forEach(function (b) {
+        var li = doc.createElement('li');
+        li.appendChild(tag(b.kind));
+        li.appendChild(tag(b.category || '?'));
+        li.appendChild(doc.createTextNode(b.host + b.path +
+          (b.origin === 'markup' ? T.markup : '')));
+        u3.appendChild(li);
+      });
+      s3.appendChild(u3);
+    }
+    body.appendChild(s3);
+    // 4. Tracker requests
+    var s4 = section(T.secRequests + ' (' + r.requests.length + ')');
+    if (!r.requests.length) {
+      s4.appendChild(el('div', { class: 'mut' }, T.noRequests));
+    } else {
+      var u4 = doc.createElement('ul');
+      r.requests.forEach(function (q) {
+        var li = doc.createElement('li');
+        li.appendChild(tag(q.when === 'after' ? T.after : T.before,
+          q.when === 'after' ? 'on' : 'off'));
+        li.appendChild(tag(q.category));
+        li.appendChild(doc.createTextNode(q.host + q.path + ' · ' + q.at + T.ms +
+          (q.count > 1 ? ' ×' + q.count : '')));
+        u4.appendChild(li);
+      });
+      s4.appendChild(u4);
+    }
+    s4.appendChild(el('p', { class: 'note' }, T.note));
+    body.appendChild(s4);
+    // 5. Consent Mode
+    var s5 = section(T.secConsentMode + ' (' + r.consentMode.length + ')');
+    if (!r.consentMode.length) {
+      s5.appendChild(el('div', { class: 'mut' }, T.noEvents));
+    } else {
+      var u5 = doc.createElement('ul');
+      r.consentMode.slice().reverse().forEach(function (c) {
+        var li = doc.createElement('li');
+        li.appendChild(tag(c.at + T.ms));
+        var txt = c.type;
+        if (c.signals) {
+          var bits = [];
+          for (var k in c.signals) {
+            if (Object.prototype.hasOwnProperty.call(c.signals, k)) {
+              bits.push(k + '=' + c.signals[k]);
+            }
+          }
+          if (bits.length) { txt += ': ' + bits.join(', '); }
+        }
+        li.appendChild(doc.createTextNode(txt));
+        u5.appendChild(li);
+      });
+      s5.appendChild(u5);
+    }
+    body.appendChild(s5);
+    // 6. Buttons
+    var s6 = section(T.secActions);
+    var row = el('div', { class: 'row' });
+    var bReset = el('button', { type: 'button' }, T.reset);
+    bReset.addEventListener('click', resetConsent);
+    var bShow = el('button', { type: 'button' }, T.showPrefs);
+    bShow.addEventListener('click', showBanner);
+    var bCopy = el('button', { type: 'button' }, T.copy);
+    bCopy.addEventListener('click', function () { copyReport(bCopy); });
+    row.appendChild(bReset); row.appendChild(bShow); row.appendChild(bCopy);
+    s6.appendChild(row);
+    s6.appendChild(el('p', { class: 'note' }, T.footer));
+    body.appendChild(s6);
+  }
+  function schedule() {
+    if (frame) { return; }
+    frame = 1;
+    var run = function () { frame = 0; try { render(); } catch (e) { /* noop */ } };
+    try {
+      if (typeof global.requestAnimationFrame === 'function') { global.requestAnimationFrame(run); }
+      else { global.setTimeout(run, 50); }
+    } catch (e) { run(); }
+  }
+  // ---------------------------------------------------------------------------
+  // Buttons
+  // ---------------------------------------------------------------------------
+  function resetConsent() {
+    try { if (CK && CK.withdraw) { CK.withdraw(); } } catch (e) { /* noop */ }
+    // withdraw() already clears the record; belt and braces for a page whose
+    // cookie was written on a parent domain.
+    try {
+      var h = global.location && global.location.hostname ? global.location.hostname : '';
+      var variants = ['', h ? '; domain=' + h : '', h ? '; domain=.' + h : ''];
+      var labels = h ? h.split('.') : [];
+      if (labels.length > 2) { variants.push('; domain=.' + labels.slice(-2).join('.')); }
+      for (var i = 0; i < variants.length; i++) {
+        doc.cookie = 'ck_consent=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/' + variants[i];
+      }
+    } catch (e) { /* noop */ }
+    lsDel('ck_consent');
+    try { global.location.reload(); } catch (e) { /* noop */ }
+  }
+  function showBanner() {
+    // Non-destructive on purpose: this opens the preferences panel and leaves
+    // the stored decision alone. Erasing consent is the other button's job, and
+    // on a live site a "show banner" click must never wipe the owner's record.
+    try { if (CK && CK.show) { CK.show(); } } catch (e) { /* noop */ }
+    schedule();
+  }
+  function copyReport(btn) {
+    var text = '';
+    try { text = JSON.stringify(buildReport(reportInput()), null, 2); } catch (e) { text = '{}'; }
+    var done = function (ok) {
+      try {
+        btn.textContent = ok ? T.copied : T.copyFailed;
+        global.setTimeout(function () { btn.textContent = T.copy; }, 1500);
+      } catch (e2) { /* noop */ }
+    };
+    try {
+      if (global.navigator && global.navigator.clipboard && global.navigator.clipboard.writeText) {
+        global.navigator.clipboard.writeText(text).then(function () { done(true); },
+          function () { done(fallbackCopy(text)); });
+        return;
+      }
+    } catch (e) { /* noop */ }
+    done(fallbackCopy(text));
+  }
+  function fallbackCopy(text) {
+    try {
+      var ta = doc.createElement('textarea');
+      ta.value = text;
+      ta.setAttribute('style', 'position:fixed;top:-9999px;left:-9999px');
+      doc.body.appendChild(ta);
+      ta.select();
+      var ok = doc.execCommand ? doc.execCommand('copy') : false;
+      doc.body.removeChild(ta);
+      return !!ok;
+    } catch (e) { return false; }
+  }
+  // ---------------------------------------------------------------------------
+  // Mount
+  // ---------------------------------------------------------------------------
+  // The banner's bar layout sits at bottom:16 across the full width and the UI's
+  // floating button at bottom-left; lift the panel above whatever is at the
+  // bottom right now so its buttons stay clickable.
+  function avoidBanner() {
+    if (!host) { return; }
+    var bottom = 12;
+    try {
+      var ckRoot = doc.getElementById('ck-root');
+      var sr = ckRoot && ckRoot.shadowRoot;
+      // The bar spans the width at bottom:16; the box-right card sits exactly
+      // where this panel does. Both must be cleared (the UI's floating button
+      // is bottom-left and never collides).
+      var banner = sr && sr.querySelector(
+        '.ck-banner--bar.ck-pos-bottom, .ck-banner--box.ck-pos-bottom-right');
+      if (banner && banner.getBoundingClientRect) {
+        var r = banner.getBoundingClientRect();
+        if (r.height > 0 && r.bottom > (global.innerHeight || 0) - r.height - 40) {
+          bottom = Math.round(r.height) + 24;
+        }
+      }
+    } catch (e) { /* noop */ }
+    try { host.style.bottom = bottom + 'px'; } catch (e2) { /* noop */ }
+  }
+  function mount() {
+    if (host || !doc.body) { return; }
+    // A page can carry the loader (inline block) AND a manual <script> tag for
+    // the panel: the second copy must not mount a second panel.
+    if (doc.querySelector('ck-debug')) { return; }
+    refreshLang();
+    host = doc.createElement('ck-debug');
+    host.setAttribute('aria-live', 'off');
+    root = host.attachShadow ? host.attachShadow({ mode: 'open' }) : null;
+    if (!root) { host = null; return; }
+    var style = doc.createElement('style');
+    style.textContent = CSS;
+    root.appendChild(style);
+    var wrap = el('div', { class: 'w', role: 'region', 'aria-label': T.regionLabel });
+    var head = el('div', { class: 'hd' });
+    head.appendChild(el('b', null, 'ConsentKit debug'));
+    head.appendChild(el('span', { class: 'sp' }));
+    toggleBtn = el('button', { type: 'button', 'aria-expanded': 'true' }, T.collapse);
+    toggleBtn.addEventListener('click', function () {
+      collapsed = !collapsed;
+      body.hidden = collapsed;
+      toggleBtn.textContent = collapsed ? T.expand : T.collapse;
+      toggleBtn.setAttribute('aria-expanded', collapsed ? 'false' : 'true');
+      if (!collapsed) { schedule(); }
+    });
+    head.appendChild(toggleBtn);
+    var closeBtn = el('button', { type: 'button', 'aria-label': T.closeLabel }, '×');
+    closeBtn.addEventListener('click', function () {
+      lsDel(LS_KEY);
+      try { host.parentNode.removeChild(host); } catch (e) { /* noop */ }
+      host = null;
+      API.active = false;
+    });
+    head.appendChild(closeBtn);
+    wrap.appendChild(head);
+    body = el('div', { class: 'bd' });
+    wrap.appendChild(body);
+    root.appendChild(wrap);
+    doc.body.appendChild(host);
+    render();
+    avoidBanner();
+  }
+  function boot() {
+    seedConsentTime();
+    stampOnDecision();
+    collectResources();
+    watchDataLayer();
+    mount();
+    try {
+      doc.addEventListener('ck:change', function () {
+        // Fallback for a decision made through some other path than
+        // accept()/rejectAll() (a host page calling into the core directly).
+        // stampOnDecision() has usually set this already, and its stamp is the
+        // accurate one — do not overwrite it here: entry.startTime is on the
+        // performance clock, and by now the revived scripts have already run.
+        try {
+          var st = CK && CK.getState ? CK.getState() : null;
+          if (st && st.decided) { if (consentAtMs === null) { consentAtMs = nowMs(); } }
+          else { consentAtMs = null; }
+        } catch (e2) { /* noop */ }
+        schedule();
+        global.setTimeout(avoidBanner, 60);
+      }, false);
+      doc.addEventListener('ck:init', function () { schedule(); global.setTimeout(avoidBanner, 60); }, false);
+    } catch (e) { /* noop */ }
+    // Late trackers and revived scripts keep arriving after the first render.
+    try { global.setInterval(schedule, 3000); } catch (e) { /* noop */ }
+    try { global.addEventListener('resize', avoidBanner, false); } catch (e) { /* noop */ }
+  }
+  try {
+    if (doc.readyState === 'loading') {
+      doc.addEventListener('DOMContentLoaded', function () { try { boot(); } catch (e) { /* noop */ } }, false);
+    } else { boot(); }
+  } catch (e) { /* noop */ }
+})(typeof window !== 'undefined' ? window : (typeof globalThis !== 'undefined' ? globalThis : this));