@ecomconsult/consentkit 0.3.4 → 0.3.5

package/README.md

@@ -348,23 +348,123 @@ external requests. Rebuild them with `tools/build-inline.mjs` (see
 [`tools/README.md`](tools/README.md)); each block's header records the exact
 command that produced it.
 
-ConsentKit 0.3.4, rebuilt 2026-09-04, uncompressed — gzip on the server cuts
+ConsentKit 0.3.5, rebuilt 2026-09-04, uncompressed — gzip on the server cuts
 this roughly three- to fourfold. Every block includes the attribution line;
 `--no-branding` takes ~200 bytes back off:
 
 | Block | Languages | Bytes |
 |---|---|---|
-| `ready/en-bar.txt` | en | 102,128 |
-| `ready/ru-bar.txt` | ru, en | 102,191 |
-| `ready/ru-box.txt` | ru, en | 102,206 |
-| `ready/ru-box-right.txt` | ru, en | 102,215 |
-| `ready/ru-modal.txt` | ru, en | 102,199 |
-| `ready/eu-bar.txt` | 34 languages | 152,403 |
+| `ready/en-bar.txt` | en | 111,664 |
+| `ready/ru-bar.txt` | ru, ro, en | 113,285 |
+| `ready/ru-box.txt` | ru, ro, en | 113,300 |
+| `ready/ru-box-right.txt` | ru, ro, en | 113,309 |
+| `ready/ru-modal.txt` | ru, ro, en | 113,293 |
+| `ready/eu-bar.txt` | 34 languages | 161,939 |
 
 Size is driven almost entirely by the bundled languages: `en` and `ru` are
 built into the UI and cost nothing extra, while layout, position, theme and
 accent change only a few bytes of config.
 
+The debug panel is **not** in these numbers. Blocks carry a ~5.1 KB loader
+(`src/ck-debug-loader.js`) which fetches the 33 KB panel only when someone opens
+the page with `?ck_debug=1` — see [Debug mode](#debug-mode). An ordinary visitor
+downloads the loader and nothing more.
+
+## Debug mode
+
+A panel that shows what the client actually did on a live page — useful when a
+site owner asks "is this thing working?" and screenshots of the banner do not
+answer it.
+
+**Open it** by adding `?ck_debug=1` to the page URL (`#ck_debug` works too):
+
+```
+https://example.com/?ck_debug=1
+```
+
+A dark, monospace panel appears bottom-right in its own Shadow DOM. The flag is
+remembered in `localStorage` for that browser, so it survives navigation.
+
+**It shows**, in order: the client version, config source (SaaS or inline),
+siteId and policy version / ETag; the consent status, granted categories,
+decision time and cookie lifetime; what the blocking engine is holding back
+(`ConsentKit._blocked()`); which requests to known trackers actually left the
+page, each marked *before* or *after* consent; the recent `ck_*` dataLayer
+events and `gtag('consent', …)` calls; and three buttons — reset consent
+(withdraw, clear the cookie, reload), open preferences, and copy a JSON report.
+
+The request list carries the same caveat as the blocking engine itself:
+requests that left **before** ck-core.js parsed — a plain `<script src>` written
+into the HTML — show up there but could not have been blocked. Mark those tags
+up manually.
+
+**Turn it off** with `?ck_debug=0`, or the × in the panel's header. The loader
+owns the stored flag, so `?ck_debug=0` clears it whether or not the panel is on
+the page.
+
+**Privacy.** Nothing is sent anywhere: the panel is local to that browser and
+that page. It never renders cookie *values* (names only) and never shows URL
+query strings (host and path only), so the copied report is safe to paste into
+a support ticket.
+
+### How the panel gets onto the page
+
+The panel is ~33 KB, and on any given page exactly one person will ever open
+it. So `ready/*.txt` and the WordPress plugin ship **`src/ck-debug-loader.js`**
+(~5.1 KB) instead, and the loader fetches the panel on demand. With no flag set
+the loader creates no DOM, installs no observers and makes **no network
+request** — it costs its own bytes and nothing else.
+
+When the panel *is* activated, the loader resolves its URL in this order, first
+match wins:
+
+1. **`window.ConsentKitDebugUrl`**, if you set it — a self-hosted copy, an
+   internal mirror, or a pinned build. Set it before the loader runs.
+2. **`<API_BASE>/client/ck-debug.js`**, when `ck-saas.js` is on the page with a
+   site id — `API_BASE` is that loader's `data-ck-api` (its `ConsentKit._saas.api`).
+   The panel then comes from the same origin as the config, so a locked-down CSP
+   needs no extra host. **A SaaS deployment is expected to serve the panel at
+   that path**; if yours does not, set `window.ConsentKitDebugUrl` instead.
+3. **jsDelivr**, pinned to the running core version:
+   `https://cdn.jsdelivr.net/npm/@ecomconsult/consentkit@<version>/src/ck-debug.js`.
+   The version comes from `ConsentKit.version`, so the panel can never be newer
+   or older than the client it is reporting on. This path is published because
+   `package.json` lists `src` in `files`.
+
+The script is injected `async`, and neither jsDelivr nor a ConsentKit API host
+is in the blocking engine's tracker list, so the panel loads even while the
+visitor has yet to decide.
+
+### Loading the panel directly
+
+If you host the files yourself and would rather have the panel inline, load it
+after `ck-ui.js` (and after `ck-saas.js` if you use it) and skip the loader:
+
+```html
+<script src="/js/ck-core.js"></script>
+<script src="/js/ck-locales.js"></script>
+<script src="/js/ck-ui.js"></script>
+<script src="/js/ck-debug.js"></script>
+```
+
+`ck-debug.js` is self-contained: it repeats the loader's activation check, so it
+works with or without the loader. Do **not** add it to a page that already ships
+the loader (an inline block from `ready/`, or the WordPress plugin) — the loader
+fetches the panel itself, and a second copy would mount a second panel.
+
+From npm it is a deliberate opt-in — `@ecomconsult/consentkit` does not pull
+it in for you. Import it yourself, after the UI:
+
+```js
+import '@ecomconsult/consentkit';           // core + locales + UI
+import '@ecomconsult/consentkit/src/ck-debug.js';
+```
+
+**Language.** The panel is Russian or English: it follows the banner's
+configured `language`, falls back to `navigator.language` (`ru-*` → Russian),
+and otherwise renders English. The JSON report it copies is language-neutral
+whichever way the panel reads.
+
 ## TypeScript
 
 Types ship with the package; no `@types` needed.

package/npm/core.cjs

@@ -21,7 +21,7 @@ function undecidedState() {
 
 function createStub() {
   return {
-    version: '0.3.4',
+    version: '0.3.5',
     config: {},
     init: function () { return undecidedState(); },
     allowed: function (cat) { return cat === 'necessary'; },

package/npm/index.cjs

@@ -24,7 +24,7 @@ function undecidedState() {
 
 function createStub() {
   return {
-    version: '0.3.4',
+    version: '0.3.5',
     config: {},
     init: function () { return undecidedState(); },
     allowed: function (cat) { return cat === 'necessary'; },

package/npm/internal-stub.mjs

@@ -28,7 +28,7 @@ export function undecidedState() {
  */
 export function createStub() {
   const stub = {
-    version: '0.3.4',
+    version: '0.3.5',
     config: {},
     init: function () { return undecidedState(); },
     allowed: function (cat) { return cat === 'necessary'; },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ecomconsult/consentkit",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "description": "GDPR cookie consent core with blocking engine, Shadow DOM UI and Google Consent Mode v2. Zero dependencies, no build step.",
   "repository": {
     "type": "git",

package/src/ck-core.js

@@ -629,7 +629,62 @@
     return !allowed(cat);
   }
 
+  // Registry of everything the engine intercepted, for the debug panel (§8.1
+  // item 3). Kept deliberately small: host + path only, никаких query strings —
+  // a tracker URL's query carries ids and, on badly built sites, PII.
+  // Capped so a page that injects trackers in a loop cannot grow it without
+  // bound; the panel shows the first BLOCKED_MAX, which is always enough to see
+  // what is happening.
+  var BLOCKED_MAX = 200;
+  var blockedLog = [];
+
+  // host + path, query and fragment dropped.
+  function safeUrlParts(src) {
+    var host = '';
+    var path = '';
+    try {
+      var base = (global.location && global.location.href) || 'http://localhost/';
+      var u = new URL(String(src), base);
+      host = (u.hostname || '').toLowerCase();
+      path = u.pathname || '';
+    } catch (e) {
+      var s = String(src || '');
+      var m = /^(?:[a-z]+:)?\/\/([^/?#]+)([^?#]*)/i.exec(s);
+      if (m) {
+        host = m[1].toLowerCase().replace(/:\d+$/, '');
+        path = m[2] || '';
+      } else {
+        path = s.split('?')[0].split('#')[0];
+      }
+    }
+    return { host: host, path: path };
+  }
+
+  function noteBlocked(el, src, cat, origin) {
+    try {
+      if (blockedLog.length >= BLOCKED_MAX) { return; }
+      var kind = 'script';
+      try {
+        var tag = el && el.tagName ? String(el.tagName).toLowerCase() : '';
+        if (tag) { kind = tag === 'img' ? 'img' : tag; }
+      } catch (e2) { /* noop */ }
+      var parts = safeUrlParts(src);
+      for (var i = 0; i < blockedLog.length; i++) {
+        var p = blockedLog[i];
+        if (p.host === parts.host && p.path === parts.path && p.kind === kind) { return; }
+      }
+      blockedLog.push({
+        host: parts.host,
+        path: parts.path,
+        kind: kind,
+        category: cat || null,
+        origin: origin || 'engine'
+      });
+    } catch (e) { /* noop */ }
+  }
+
   function markBlocked(el, src, cat) {
+    noteBlocked(el, src, cat, 'engine');
     try {
       if (nativeSetAttribute) {
         nativeSetAttribute.call(el, 'data-ck-blocked', '1');
@@ -961,7 +1016,7 @@
   // Public API
   // ---------------------------------------------------------------------------
   var ConsentKit = {
-    version: '0.3.4',
+    version: '0.3.5',
     config: config,
 
     init: function (userConfig) {
@@ -1017,7 +1072,58 @@
 
     // Introspection helpers for the demo status panel (read-only).
     _categoryForUrl: categoryForUrl,
-    _categories: CATEGORIES.slice()
+    _categories: CATEGORIES.slice(),
+
+    // What is being held back until consent: everything the engine intercepted
+    // (origin 'engine') plus what the site author marked up by hand (origin
+    // 'markup'), which never goes through markBlocked. Read-only, host+path
+    // only — no query strings, so no ids and no PII. Used by src/ck-debug.js.
+    _blocked: function () {
+      var out = [];
+      var seen = {};
+      function add(rec) {
+        var key = rec.kind + '|' + rec.host + '|' + rec.path;
+        if (seen[key]) { return; }
+        seen[key] = 1;
+        out.push(rec);
+      }
+      try {
+        for (var i = 0; i < blockedLog.length; i++) {
+          var b = blockedLog[i];
+          // Interceptions are kept for the life of the page, but once the
+          // category is granted the element has been revived and is no longer
+          // held back — reporting it as still blocked would be false.
+          if (allowed(b.category)) { continue; }
+          add({ host: b.host, path: b.path, kind: b.kind, category: b.category, origin: b.origin });
+        }
+      } catch (e) { /* noop */ }
+      // Hand-marked tags still waiting for their category.
+      try {
+        // Only what applyConsentToDom() can actually revive. An img is never
+        // revived by the core, so listing hand-marked images here would show a
+        // pending state that never clears after the visitor accepts.
+        qsa('script[type="text/plain"][data-ck], iframe[data-ck][data-src]')
+          .forEach(function (el) {
+            try {
+              if (el.getAttribute('data-ck-restored')) { return; }
+              if (el.getAttribute('data-ck-blocked')) { return; } // already in the registry
+              var tag = String(el.tagName || '').toLowerCase();
+              if (tag === 'iframe' && el.getAttribute('src')) { return; }
+              var src = el.getAttribute('data-src') || el.getAttribute('data-ck-src') || '';
+              if (!src) { return; }
+              var cat = el.getAttribute('data-ck') || categoryForUrl(src);
+              if (allowed(cat)) { return; }
+              var parts = safeUrlParts(src);
+              add({
+                host: parts.host, path: parts.path,
+                kind: tag === 'iframe' ? 'iframe' : 'script',
+                category: cat || null, origin: 'markup'
+              });
+            } catch (e2) { /* noop */ }
+          });
+      } catch (e3) { /* noop */ }
+      return out;
+    }
   };
 
   // ---------------------------------------------------------------------------

package/src/ck-debug-loader.js

@@ -0,0 +1,134 @@
+/*!
+ * ConsentKit debug loader — the activation switch for the debug panel.
+ *
+ * The panel itself (src/ck-debug.js) is ~30 KB and useful to exactly one
+ * person on the page: the site owner, once, while diagnosing something. This
+ * loader ships instead of it in the inline blocks and in the WordPress plugin,
+ * and fetches the panel only when the visitor asks for it. Without activation
+ * it creates no DOM, installs no observers and makes no network request.
+ *
+ * Activation (?ck_debug=1 / #ck_debug / localStorage) and the three-step
+ * resolution order for the panel URL are documented in README «Debug mode».
+ * Two things are worth knowing while reading this file:
+ *
+ *   - The off switch has to work even though the panel is not loaded, so the
+ *     loader — not the panel — owns the stored flag. ck-debug.js keeps its own
+ *     identical copy of parseActivation() because it is loaded directly on our
+ *     demo page and must stay self-contained; writing the flag twice is
+ *     idempotent, and test/debug-loader.test.mjs asserts the two agree.
+ *   - Nothing here runs before activation. No DOM, no request, no observers.
+ *
+ * Load order: ck-core.js -> ck-locales.js -> ck-ui.js -> [ck-saas.js] -> this.
+ *
+ * Copyright (c) 2026 E-COM CONSULT PLUS. MIT License — see LICENSE.
+ */
+(function (global) {
+  'use strict';
+
+  if (!global || typeof global !== 'object') { return; }
+
+  var LS_KEY = 'ck_debug';
+  var CDN = 'https://cdn.jsdelivr.net/npm/@ecomconsult/consentkit@';
+
+  function isOffValue(v) {
+    return v === '0' || v === 'false' || v === 'no' || v === '';
+  }
+
+  // Identical to src/ck-debug.js parseActivation(). Pure: no DOM, no storage.
+  function parseActivation(search, hash, stored) {
+    var on = null;
+
+    var q = String(search || '');
+    if (q.charAt(0) === '?') { q = q.slice(1); }
+    var pairs = q ? q.split('&') : [];
+    for (var i = 0; i < pairs.length; i++) {
+      var eq = pairs[i].indexOf('=');
+      var k = eq === -1 ? pairs[i] : pairs[i].slice(0, eq);
+      if (k !== LS_KEY) { continue; }
+      on = eq === -1 ? true : !isOffValue(pairs[i].slice(eq + 1));
+    }
+
+    if (on === null) {
+      var h = String(hash || '');
+      if (h.charAt(0) === '#') { h = h.slice(1); }
+      if (h === LS_KEY) { on = true; }
+      else if (h.indexOf(LS_KEY + '=') === 0) { on = !isOffValue(h.slice(LS_KEY.length + 1)); }
+    }
+
+    if (on === null) {
+      return { active: String(stored || '') === '1', persist: null };
+    }
+    return { active: on, persist: on ? 'on' : 'off' };
+  }
+
+  // Pure: takes what the page happens to expose, returns the URL to load.
+  // `explicit` is window.ConsentKitDebugUrl, `saas` is ConsentKit._saas.
+  // Order: explicit URL -> SaaS API origin -> jsDelivr pinned to the running
+  // core version. See README «Debug mode».
+  function resolveUrl(explicit, saas, version) {
+    var pinned = String(explicit || '').trim();
+    if (pinned) { return pinned; }
+
+    if (saas && saas.siteId && saas.api) {
+      var base = String(saas.api).replace(/\/+$/, '');
+      if (base) { return base + '/client/ck-debug.js'; }
+    }
+
+    return CDN + encodeURIComponent(String(version || 'latest')) + '/src/ck-debug.js';
+  }
+
+  var API = {
+    parseActivation: parseActivation,
+    resolveUrl: resolveUrl,
+    active: false,
+    url: null
+  };
+  try {
+    if (global.ConsentKit) { global.ConsentKit._debugLoader = API; }
+    global.__ckDebugLoader = API;
+  } catch (e) { /* noop */ }
+
+  function lsGet(k) {
+    try { return global.localStorage ? global.localStorage.getItem(k) : null; } catch (e) { return null; }
+  }
+  function lsSet(k, v) {
+    try { if (global.localStorage) { global.localStorage.setItem(k, v); } } catch (e) { /* noop */ }
+  }
+  function lsDel(k) {
+    try { if (global.localStorage) { global.localStorage.removeItem(k); } } catch (e) { /* noop */ }
+  }
+
+  var loc = global.location;
+  var act = parseActivation(loc && loc.search, loc && loc.hash, lsGet(LS_KEY));
+  // Persist BEFORE the early return: ?ck_debug=0 has to clear the stored flag
+  // even though nothing is loaded afterwards, or the panel could never be
+  // switched off again once it had been switched on.
+  if (act.persist === 'on') { lsSet(LS_KEY, '1'); }
+  if (act.persist === 'off') { lsDel(LS_KEY); }
+  if (!act.active) { return; }
+
+  var doc = global.document;
+  if (!doc || typeof doc.createElement !== 'function') { return; }
+
+  // Already loaded (the panel published its surface, or this ran twice).
+  if (global.__ckDebug) { API.active = true; return; }
+
+  var CK = global.ConsentKit;
+  var url = resolveUrl(
+    global.ConsentKitDebugUrl,
+    CK && CK._saas,
+    (CK && CK.version) || ''
+  );
+  API.active = true;
+  API.url = url;
+
+  try {
+    var s = doc.createElement('script');
+    s.src = url;
+    s.async = true;
+    // No opt-out attribute is needed: the blocking engine matches a fixed list
+    // of tracker hosts, and neither jsDelivr nor a ConsentKit API host is on
+    // it — test/debug-loader.test.mjs asserts that.
+    (doc.head || doc.body || doc.documentElement).appendChild(s);
+  } catch (e) { /* noop */ }
+})(typeof window !== 'undefined' ? window : (typeof globalThis !== 'undefined' ? globalThis : this));

package/src/ck-debug.js

@@ -0,0 +1,847 @@
+/*!
+ * ConsentKit debug panel (opt-in) — shows what the banner actually did on this
+ * page. Off by default: without activation this file creates no DOM, installs
+ * no observers and touches nothing.
+ *
+ * Activation (this browser only, nothing is sent anywhere):
+ *   ?ck_debug=1  or  #ck_debug   — turns it on and remembers it (localStorage)
+ *   ?ck_debug=0                  — turns it off and forgets it
+ *   localStorage.ck_debug = '1'  — same as the query parameter
+ *
+ * Load order: ck-core.js -> ck-locales.js -> ck-ui.js -> [ck-saas.js] -> ck-debug.js
+ *
+ * Copyright (c) 2026 E-COM CONSULT PLUS. MIT License — see LICENSE.
+ */
+(function (global) {
+  'use strict';
+
+  if (!global || typeof global !== 'object') { return; }
+
+  var LS_KEY = 'ck_debug';
+
+  // ---------------------------------------------------------------------------
+  // Activation (pure, testable: no DOM, no storage)
+  // ---------------------------------------------------------------------------
+  // Returns { active, persist } where persist is 'on' | 'off' | null:
+  // the query/hash form is sticky so the panel survives navigation, the bare
+  // localStorage form changes nothing.
+  function isOffValue(v) {
+    return v === '0' || v === 'false' || v === 'no' || v === '';
+  }
+
+  function parseActivation(search, hash, stored) {
+    var on = null;
+
+    var q = String(search || '');
+    if (q.charAt(0) === '?') { q = q.slice(1); }
+    var pairs = q ? q.split('&') : [];
+    for (var i = 0; i < pairs.length; i++) {
+      var eq = pairs[i].indexOf('=');
+      var k = eq === -1 ? pairs[i] : pairs[i].slice(0, eq);
+      if (k !== LS_KEY) { continue; }
+      // ?ck_debug (no "="), ?ck_debug=1, =true, =yes -> on
+      // ?ck_debug=0, =false, =no, =(empty) -> off. The empty value is treated
+      // as off deliberately: a form or a link builder that drops the value is
+      // far more likely to mean "not set" than "switch the panel on".
+      on = eq === -1 ? true : !isOffValue(pairs[i].slice(eq + 1));
+    }
+
+    if (on === null) {
+      var h = String(hash || '');
+      if (h.charAt(0) === '#') { h = h.slice(1); }
+      // #ck_debug or #ck_debug=1 (a plain fragment id, not a query)
+      if (h === LS_KEY) { on = true; }
+      else if (h.indexOf(LS_KEY + '=') === 0) { on = !isOffValue(h.slice(LS_KEY.length + 1)); }
+    }
+
+    if (on === null) {
+      return { active: String(stored || '') === '1', persist: null };
+    }
+    return { active: on, persist: on ? 'on' : 'off' };
+  }
+
+  // ---------------------------------------------------------------------------
+  // Report (pure, testable: takes plain data, returns plain data)
+  // ---------------------------------------------------------------------------
+  // No PII by construction: cookie names only (never values), host + path only
+  // (never query strings — tracker URLs carry ids there).
+  function stripUrl(url) {
+    var s = String(url || '');
+    var host = '';
+    var path = '';
+    var m = /^(?:[a-z]+:)?\/\/([^/?#]+)([^?#]*)/i.exec(s);
+    if (m) {
+      host = m[1].toLowerCase().replace(/:\d+$/, '');
+      path = m[2] || '';
+    } else {
+      path = s.split('?')[0].split('#')[0];
+    }
+    return { host: host, path: path };
+  }
+
+  // entries: PerformanceResourceTiming-like [{ name, startTime, initiatorType }]
+  // consentAtMs: performance-clock ms of the decision, or null when undecided
+  // classify: url -> category | null (ConsentKit._categoryForUrl)
+  function buildRequests(entries, consentAtMs, classify) {
+    var out = [];
+    var list = entries || [];
+    var seen = {};
+    for (var i = 0; i < list.length; i++) {
+      var e = list[i];
+      if (!e || !e.name) { continue; }
+      var cat = null;
+      try { cat = classify ? classify(e.name) : null; } catch (err) { cat = null; }
+      if (!cat) { continue; }                       // only known trackers
+      var p = stripUrl(e.name);
+      var t = Number(e.startTime) || 0;
+      var when = consentAtMs === null || consentAtMs === undefined
+        ? 'before' : (t >= consentAtMs ? 'after' : 'before');
+      var key = p.host + '|' + p.path + '|' + when;
+      if (seen[key]) { seen[key].count++; continue; }
+      var rec = {
+        host: p.host, path: p.path, category: cat, when: when,
+        at: Math.round(t), kind: String((e && e.initiatorType) || ''), count: 1
+      };
+      seen[key] = rec;
+      out.push(rec);
+    }
+    return out;
+  }
+
+  function buildReport(input) {
+    var d = input || {};
+    var st = d.state || {};
+    var cats = st.categories || {};
+    return {
+      generatedAt: d.now || null,
+      client: {
+        version: d.version || null,
+        source: d.siteId ? 'saas' : 'inline',
+        siteId: d.siteId || null,
+        policyVersion: st.policyVersion || (d.config && d.config.policyVersion) || null,
+        etag: d.etag || null
+      },
+      consent: {
+        status: !st.decided ? 'none'
+          : (cats.functional && cats.analytics && cats.marketing) ? 'accepted'
+          : (!cats.functional && !cats.analytics && !cats.marketing) ? 'rejected'
+          : 'partial',
+        categories: {
+          necessary: true,
+          functional: !!cats.functional,
+          analytics: !!cats.analytics,
+          marketing: !!cats.marketing
+        },
+        decidedAt: st.ts || null,
+        method: st.method || null,
+        ttlDays: d.ttlDays == null ? null : Number(d.ttlDays)
+      },
+      blocked: (d.blocked || []).map(function (b) {
+        return { host: b.host, path: b.path, kind: b.kind, category: b.category, origin: b.origin };
+      }),
+      requests: buildRequests(d.entries, d.consentAtMs, d.classify),
+      consentMode: (d.consentMode || []).slice(),
+      // Names only — a consent debug panel must never leak cookie contents.
+      cookieNames: (d.cookieNames || []).slice(),
+      note: NOTE_EN
+    };
+  }
+
+  var NOTE_RU = 'Запросы, ушедшие до загрузки ConsentKit (обычный <script src> ' +
+    'в разметке), видны в этом списке, но заблокировать их клиент не может — ' +
+    'такие теги размечают вручную.';
+  var NOTE_EN = 'Requests that left before ConsentKit loaded (a plain <script src> ' +
+    'written into the HTML) show up here but cannot be blocked — mark such tags up manually.';
+
+  // ---------------------------------------------------------------------------
+  // Panel language (pure; the JSON report stays language-neutral either way)
+  // ---------------------------------------------------------------------------
+  // The panel is read by whoever is debugging the site, so it follows the same
+  // language the banner resolved for this visitor rather than a build flag.
+  // Only ru and en exist: this is an internal diagnostic surface, and a
+  // half-translated one is worse than an English one.
+  var STRINGS = {
+    ru: {
+      regionLabel: 'ConsentKit — режим отладки',
+      collapse: 'Свернуть',
+      expand: 'Развернуть',
+      closeLabel: 'Закрыть и выключить режим отладки',
+      secClient: 'Клиент',
+      version: 'версия',
+      source: 'источник',
+      srcSaas: 'SaaS',
+      srcInline: 'инлайн',
+      secConsent: 'Согласие',
+      decidedAt: 'решение',
+      method: 'способ',
+      ttl: 'срок cookie',
+      days: ' дн.',
+      status: { none: 'нет решения', accepted: 'принято', rejected: 'отклонено', partial: 'частично' },
+      secBlocked: 'Заблокировано до согласия',
+      noBlocked: 'ничего не перехвачено',
+      markup: ' (разметка)',
+      secRequests: 'Запросы к трекерам',
+      noRequests: 'запросов к известным трекерам не было',
+      after: 'после согласия',
+      before: 'до согласия',
+      ms: ' мс',
+      note: NOTE_RU,
+      secConsentMode: 'Consent Mode / dataLayer',
+      noEvents: 'событий не было',
+      secActions: 'Действия',
+      reset: 'Сбросить согласие',
+      showPrefs: 'Показать настройки',
+      copy: 'Скопировать отчёт',
+      copied: 'Скопировано',
+      copyFailed: 'Не вышло',
+      footer: 'Панель видна только в этом браузере. Выключить: добавьте ?ck_debug=0 к адресу.'
+    },
+    en: {
+      regionLabel: 'ConsentKit — debug mode',
+      collapse: 'Collapse',
+      expand: 'Expand',
+      closeLabel: 'Close and turn debug mode off',
+      secClient: 'Client',
+      version: 'version',
+      source: 'source',
+      srcSaas: 'SaaS',
+      srcInline: 'inline',
+      secConsent: 'Consent',
+      decidedAt: 'decided',
+      method: 'method',
+      ttl: 'cookie lifetime',
+      days: ' days',
+      status: { none: 'no decision', accepted: 'accepted', rejected: 'rejected', partial: 'partial' },
+      secBlocked: 'Blocked until consent',
+      noBlocked: 'nothing intercepted',
+      markup: ' (markup)',
+      secRequests: 'Tracker requests',
+      noRequests: 'no requests to known trackers',
+      after: 'after consent',
+      before: 'before consent',
+      ms: ' ms',
+      note: NOTE_EN,
+      secConsentMode: 'Consent Mode / dataLayer',
+      noEvents: 'no events',
+      secActions: 'Actions',
+      reset: 'Reset consent',
+      showPrefs: 'Show preferences',
+      copy: 'Copy report',
+      copied: 'Copied',
+      copyFailed: 'Failed',
+      footer: 'This panel is visible in this browser only. To turn it off, add ?ck_debug=0 to the URL.'
+    }
+  };
+
+  // banner language (ConsentKit config) -> navigator.language -> en.
+  // `cfgLang` is ConsentKit.config.language, which may be 'auto'.
+  function pickLang(cfgLang, navLang) {
+    var raw = String(cfgLang || '').toLowerCase();
+    if (!raw || raw === 'auto') { raw = String(navLang || '').toLowerCase(); }
+    return raw.slice(0, 2) === 'ru' ? 'ru' : 'en';
+  }
+
+  // Testable surface. Published before the activation check so the inactive
+  // path is testable too; it is not a public API.
+  var API = {
+    parseActivation: parseActivation,
+    buildReport: buildReport,
+    buildRequests: buildRequests,
+    stripUrl: stripUrl,
+    pickLang: pickLang,
+    strings: STRINGS,
+    active: false
+  };
+  try {
+    if (global.ConsentKit) { global.ConsentKit._debug = API; }
+    global.__ckDebug = API;
+  } catch (e) { /* noop */ }
+
+  // ---------------------------------------------------------------------------
+  // Everything below runs only when activated.
+  // ---------------------------------------------------------------------------
+  var doc = global.document;
+  var loc = global.location;
+
+  function lsGet(k) {
+    try { return global.localStorage ? global.localStorage.getItem(k) : null; } catch (e) { return null; }
+  }
+  function lsSet(k, v) {
+    try { if (global.localStorage) { global.localStorage.setItem(k, v); } } catch (e) { /* noop */ }
+  }
+  function lsDel(k) {
+    try { if (global.localStorage) { global.localStorage.removeItem(k); } } catch (e) { /* noop */ }
+  }
+
+  var act = parseActivation(loc && loc.search, loc && loc.hash, lsGet(LS_KEY));
+  if (act.persist === 'on') { lsSet(LS_KEY, '1'); }
+  if (act.persist === 'off') { lsDel(LS_KEY); }
+  if (!act.active) { return; }
+  if (!doc || typeof doc.createElement !== 'function') { return; }
+  API.active = true;
+
+  var CK = global.ConsentKit;
+
+  // ---------------------------------------------------------------------------
+  // Observation (installed only when active)
+  // ---------------------------------------------------------------------------
+  var resources = [];
+  var consentAtMs = null;          // performance clock, set when consent is given
+  var consentMode = [];            // last ck_* dataLayer events and gtag consent calls
+  var CM_MAX = 20;
+
+  function nowMs() {
+    try {
+      if (global.performance && typeof global.performance.now === 'function') {
+        return global.performance.now();
+      }
+    } catch (e) { /* noop */ }
+    return 0;
+  }
+
+  // A decision restored from a previous page load happened before this page
+  // started, so every request on this load counts as "after".
+  function seedConsentTime() {
+    try {
+      var st = CK && CK.getState ? CK.getState() : null;
+      if (st && st.decided && consentAtMs === null) { consentAtMs = 0; }
+    } catch (e) { /* noop */ }
+  }
+
+  // Stamp the moment the visitor decides, BEFORE the core acts on it.
+  //
+  // This cannot wait for ck:change: accept() revives the blocked scripts
+  // synchronously and dispatches ck:change afterwards, so by the time the event
+  // fires those scripts have already issued their requests. Stamping on the
+  // event would then place them *before* the cutoff and the panel would report
+  // "до согласия" for the very requests the consent just released — exactly
+  // backwards, and on the one line an owner reads most carefully.
+  //
+  // Wrapping is observe-only: the original method is called with the original
+  // arguments and its return value passed straight back.
+  function stampOnDecision() {
+    try {
+      if (!CK) { return; }
+      ['accept', 'rejectAll'].forEach(function (name) {
+        var orig = CK[name];
+        if (typeof orig !== 'function' || orig.__ckDebugWrapped) { return; }
+        var wrapped = function () {
+          try { consentAtMs = nowMs(); } catch (e) { /* noop */ }
+          return orig.apply(CK, arguments);
+        };
+        wrapped.__ckDebugWrapped = true;
+        CK[name] = wrapped;
+      });
+      // withdraw() puts the page back to "no decision yet".
+      var w = CK.withdraw;
+      if (typeof w === 'function' && !w.__ckDebugWrapped) {
+        var wrappedW = function () {
+          try { consentAtMs = null; } catch (e) { /* noop */ }
+          return w.apply(CK, arguments);
+        };
+        wrappedW.__ckDebugWrapped = true;
+        CK.withdraw = wrappedW;
+      }
+    } catch (e) { /* noop */ }
+  }
+
+  function collectResources() {
+    try {
+      var perf = global.performance;
+      if (!perf) { return; }
+      if (typeof perf.getEntriesByType === 'function') {
+        var buffered = perf.getEntriesByType('resource') || [];
+        for (var i = 0; i < buffered.length; i++) { resources.push(buffered[i]); }
+      }
+      if (typeof global.PerformanceObserver === 'function') {
+        var po = new global.PerformanceObserver(function (list) {
+          try {
+            var got = list.getEntries() || [];
+            for (var j = 0; j < got.length; j++) { resources.push(got[j]); }
+            schedule();
+          } catch (e2) { /* noop */ }
+        });
+        // buffered:true re-delivers what happened before we attached; harmless
+        // duplicates are deduped when the list is rendered.
+        try { po.observe({ type: 'resource', buffered: true }); }
+        catch (e3) { try { po.observe({ entryTypes: ['resource'] }); } catch (e4) { /* noop */ } }
+      }
+    } catch (e) { /* noop */ }
+  }
+
+  // Observe only: the existing dataLayer.push is called first and its return
+  // value passed through, so a GTM/other wrapper keeps working.
+  function watchDataLayer() {
+    try {
+      var dl = global.dataLayer;
+      if (!dl) { global.dataLayer = dl = []; }
+      if (typeof dl.push !== 'function' || dl.__ckDebugWatched) { return; }
+      // Whatever is already in the queue counts too.
+      for (var i = 0; i < dl.length; i++) { noteDataLayer(dl[i]); }
+      var prev = dl.push;
+      dl.push = function () {
+        try {
+          for (var j = 0; j < arguments.length; j++) { noteDataLayer(arguments[j]); }
+        } catch (e) { /* never break the host page */ }
+        return prev.apply(this, arguments);
+      };
+      dl.__ckDebugWatched = true;
+    } catch (e) { /* noop */ }
+  }
+
+  function noteDataLayer(arg) {
+    try {
+      var rec = null;
+      // gtag() pushes an arguments object: ['consent', 'default'|'update', {...}]
+      if (arg && typeof arg === 'object' && typeof arg.length === 'number' && arg[0] === 'consent') {
+        var signals = {};
+        var payload = arg[2];
+        if (payload && typeof payload === 'object') {
+          for (var k in payload) {
+            if (Object.prototype.hasOwnProperty.call(payload, k)) { signals[k] = payload[k]; }
+          }
+        }
+        rec = { type: 'gtag consent ' + String(arg[1] || ''), signals: signals, at: Math.round(nowMs()) };
+      } else if (arg && typeof arg === 'object' && typeof arg.event === 'string' &&
+                 arg.event.indexOf('ck_') === 0) {
+        rec = { type: arg.event, signals: null, at: Math.round(nowMs()) };
+      }
+      if (!rec) { return; }
+      consentMode.push(rec);
+      if (consentMode.length > CM_MAX) { consentMode.shift(); }
+      schedule();
+    } catch (e) { /* noop */ }
+  }
+
+  function cookieNames() {
+    var names = [];
+    try {
+      var raw = typeof doc.cookie === 'string' ? doc.cookie : '';
+      var parts = raw.split(';');
+      for (var i = 0; i < parts.length; i++) {
+        var t = parts[i].trim();
+        if (!t) { continue; }
+        var eq = t.indexOf('=');
+        names.push(eq === -1 ? t : t.slice(0, eq));   // name only, never the value
+      }
+    } catch (e) { /* noop */ }
+    return names;
+  }
+
+  function saasInfo() {
+    var out = { siteId: null, etag: null };
+    try {
+      if (CK && CK._saas) {
+        out.siteId = CK._saas.siteId || null;
+        var cached = null;
+        try {
+          var raw = lsGet('ck_cfg_' + out.siteId);
+          cached = raw ? JSON.parse(raw) : null;
+        } catch (e2) { cached = null; }
+        out.etag = cached && cached.etag ? cached.etag : null;
+      }
+    } catch (e) { /* noop */ }
+    return out;
+  }
+
+  function reportInput() {
+    var s = saasInfo();
+    var cfg = (CK && CK.config) || {};
+    return {
+      now: new Date().toISOString(),
+      version: CK ? CK.version : null,
+      state: CK && CK.getState ? CK.getState() : {},
+      config: cfg,
+      siteId: s.siteId,
+      etag: s.etag,
+      ttlDays: cfg.consentTtlDays == null ? null : cfg.consentTtlDays,
+      blocked: (CK && typeof CK._blocked === 'function') ? CK._blocked() : [],
+      entries: resources,
+      consentAtMs: consentAtMs,
+      classify: CK ? CK._categoryForUrl : null,
+      consentMode: consentMode,
+      cookieNames: cookieNames()
+    };
+  }
+
+  // ---------------------------------------------------------------------------
+  // Panel (own Shadow DOM host, own styles)
+  // ---------------------------------------------------------------------------
+  var CSS = [
+    ':host{all:initial;position:fixed;right:12px;bottom:12px;z-index:2147483646;',
+    'font:12px/1.45 ui-monospace,SFMono-Regular,Menlo,Consolas,"Liberation Mono",monospace}',
+    '*{box-sizing:border-box}',
+    '.w{width:min(360px,calc(100vw - 24px));background:#12151c;color:#dfe3ea;',
+    'border:1px solid #2b3040;border-radius:8px;box-shadow:0 6px 24px rgba(0,0,0,.4);overflow:hidden}',
+    '.hd{display:flex;align-items:center;gap:8px;padding:7px 9px;background:#1a1f2a;',
+    'border-bottom:1px solid #2b3040}',
+    '.hd b{font-weight:600;color:#fff;font-size:12px}',
+    '.hd .sp{flex:1}',
+    'button{font:inherit;color:#dfe3ea;background:#232936;border:1px solid #39415400;',
+    'border-color:#394154;border-radius:5px;padding:3px 8px;cursor:pointer}',
+    'button:hover{background:#2c3444}',
+    'button:focus-visible{outline:2px solid #7aa2ff;outline-offset:1px}',
+    '.bd{max-height:min(60vh,460px);overflow:auto;padding:2px 9px 9px}',
+    '.bd[hidden]{display:none}',
+    'section{border-top:1px solid #232936;padding:7px 0}',
+    'section:first-child{border-top:0}',
+    'h2{margin:0 0 4px;font-size:11px;font-weight:600;color:#8d96ab;text-transform:uppercase;',
+    'letter-spacing:.04em}',
+    'dl{margin:0;display:grid;grid-template-columns:auto 1fr;gap:1px 8px}',
+    'dt{color:#8d96ab}',
+    'dd{margin:0;overflow-wrap:anywhere}',
+    'ul{margin:0;padding:0;list-style:none}',
+    'li{padding:2px 0;border-top:1px dotted #262c3a;overflow-wrap:anywhere}',
+    'li:first-child{border-top:0}',
+    '.t{display:inline-block;padding:0 5px;border-radius:3px;font-size:10px;',
+    'background:#2a3142;color:#a9b3c9;margin-right:4px}',
+    '.t.on{background:#173a24;color:#7ee2a0}',
+    '.t.off{background:#3a1a1d;color:#ff9aa2}',
+    '.mut{color:#8d96ab}',
+    '.note{margin:6px 0 0;color:#8d96ab;font-size:11px;line-height:1.4}',
+    '.row{display:flex;gap:6px;flex-wrap:wrap;margin-top:8px}',
+    '@media (prefers-reduced-motion:no-preference){button{transition:background-color .12s ease}}'
+  ].join('');
+
+  var host = null, root = null, body = null, toggleBtn = null, collapsed = false;
+  var frame = 0;
+
+  function el(tag, attrs, text) {
+    var n = doc.createElement(tag);
+    if (attrs) {
+      for (var k in attrs) {
+        if (Object.prototype.hasOwnProperty.call(attrs, k)) { n.setAttribute(k, attrs[k]); }
+      }
+    }
+    if (text != null) { n.textContent = String(text); }
+    return n;
+  }
+
+  function section(title) {
+    var s = doc.createElement('section');
+    s.appendChild(el('h2', null, title));
+    return s;
+  }
+
+  function defs(pairs) {
+    var dl = doc.createElement('dl');
+    for (var i = 0; i < pairs.length; i++) {
+      dl.appendChild(el('dt', null, pairs[i][0]));
+      dl.appendChild(el('dd', null, pairs[i][1] == null || pairs[i][1] === '' ? '—' : pairs[i][1]));
+    }
+    return dl;
+  }
+
+  function tag(text, cls) { return el('span', { class: 't' + (cls ? ' ' + cls : '') }, text); }
+
+  // Resolved lazily, not at parse time: this file runs before ConsentKit.init()
+  // has merged the site's config, so asking for the language now would always
+  // read the built-in default. Re-resolved on every render so a page that
+  // switches language at runtime switches the panel too.
+  var T = STRINGS.en;
+  function refreshLang() {
+    var nav = global.navigator;
+    T = STRINGS[pickLang(
+      (CK && CK.config && CK.config.language) || '',
+      (nav && (nav.language || nav.userLanguage)) || ''
+    )] || STRINGS.en;
+    return T;
+  }
+
+  function render() {
+    if (!body) { return; }
+    refreshLang();
+    var r = buildReport(reportInput());
+    body.textContent = '';
+
+    // 1. Client
+    var s1 = section(T.secClient);
+    s1.appendChild(defs([
+      [T.version, r.client.version],
+      [T.source, r.client.source === 'saas' ? T.srcSaas : T.srcInline],
+      ['siteId', r.client.siteId],
+      ['policyVersion', r.client.policyVersion],
+      ['ETag', r.client.etag]
+    ]));
+    body.appendChild(s1);
+
+    // 2. Consent
+    var s2 = section(T.secConsent);
+    var line = el('div');
+    line.appendChild(tag(T.status[r.consent.status] || r.consent.status,
+      r.consent.status === 'accepted' ? 'on' : r.consent.status === 'rejected' ? 'off' : ''));
+    s2.appendChild(line);
+    var cl = doc.createElement('div');
+    ['necessary', 'functional', 'analytics', 'marketing'].forEach(function (c) {
+      cl.appendChild(tag((r.consent.categories[c] ? '✓ ' : '✗ ') + c,
+        r.consent.categories[c] ? 'on' : 'off'));
+    });
+    s2.appendChild(cl);
+    s2.appendChild(defs([
+      [T.decidedAt, r.consent.decidedAt],
+      [T.method, r.consent.method],
+      [T.ttl, r.consent.ttlDays == null ? null : r.consent.ttlDays + T.days]
+    ]));
+    body.appendChild(s2);
+
+    // 3. Blocked until consent
+    var s3 = section(T.secBlocked + ' (' + r.blocked.length + ')');
+    if (!r.blocked.length) {
+      s3.appendChild(el('div', { class: 'mut' }, T.noBlocked));
+    } else {
+      var u3 = doc.createElement('ul');
+      r.blocked.forEach(function (b) {
+        var li = doc.createElement('li');
+        li.appendChild(tag(b.kind));
+        li.appendChild(tag(b.category || '?'));
+        li.appendChild(doc.createTextNode(b.host + b.path +
+          (b.origin === 'markup' ? T.markup : '')));
+        u3.appendChild(li);
+      });
+      s3.appendChild(u3);
+    }
+    body.appendChild(s3);
+
+    // 4. Tracker requests
+    var s4 = section(T.secRequests + ' (' + r.requests.length + ')');
+    if (!r.requests.length) {
+      s4.appendChild(el('div', { class: 'mut' }, T.noRequests));
+    } else {
+      var u4 = doc.createElement('ul');
+      r.requests.forEach(function (q) {
+        var li = doc.createElement('li');
+        li.appendChild(tag(q.when === 'after' ? T.after : T.before,
+          q.when === 'after' ? 'on' : 'off'));
+        li.appendChild(tag(q.category));
+        li.appendChild(doc.createTextNode(q.host + q.path + ' · ' + q.at + T.ms +
+          (q.count > 1 ? ' ×' + q.count : '')));
+        u4.appendChild(li);
+      });
+      s4.appendChild(u4);
+    }
+    s4.appendChild(el('p', { class: 'note' }, T.note));
+    body.appendChild(s4);
+
+    // 5. Consent Mode
+    var s5 = section(T.secConsentMode + ' (' + r.consentMode.length + ')');
+    if (!r.consentMode.length) {
+      s5.appendChild(el('div', { class: 'mut' }, T.noEvents));
+    } else {
+      var u5 = doc.createElement('ul');
+      r.consentMode.slice().reverse().forEach(function (c) {
+        var li = doc.createElement('li');
+        li.appendChild(tag(c.at + T.ms));
+        var txt = c.type;
+        if (c.signals) {
+          var bits = [];
+          for (var k in c.signals) {
+            if (Object.prototype.hasOwnProperty.call(c.signals, k)) {
+              bits.push(k + '=' + c.signals[k]);
+            }
+          }
+          if (bits.length) { txt += ': ' + bits.join(', '); }
+        }
+        li.appendChild(doc.createTextNode(txt));
+        u5.appendChild(li);
+      });
+      s5.appendChild(u5);
+    }
+    body.appendChild(s5);
+
+    // 6. Buttons
+    var s6 = section(T.secActions);
+    var row = el('div', { class: 'row' });
+    var bReset = el('button', { type: 'button' }, T.reset);
+    bReset.addEventListener('click', resetConsent);
+    var bShow = el('button', { type: 'button' }, T.showPrefs);
+    bShow.addEventListener('click', showBanner);
+    var bCopy = el('button', { type: 'button' }, T.copy);
+    bCopy.addEventListener('click', function () { copyReport(bCopy); });
+    row.appendChild(bReset); row.appendChild(bShow); row.appendChild(bCopy);
+    s6.appendChild(row);
+    s6.appendChild(el('p', { class: 'note' }, T.footer));
+    body.appendChild(s6);
+  }
+
+  function schedule() {
+    if (frame) { return; }
+    frame = 1;
+    var run = function () { frame = 0; try { render(); } catch (e) { /* noop */ } };
+    try {
+      if (typeof global.requestAnimationFrame === 'function') { global.requestAnimationFrame(run); }
+      else { global.setTimeout(run, 50); }
+    } catch (e) { run(); }
+  }
+
+  // ---------------------------------------------------------------------------
+  // Buttons
+  // ---------------------------------------------------------------------------
+  function resetConsent() {
+    try { if (CK && CK.withdraw) { CK.withdraw(); } } catch (e) { /* noop */ }
+    // withdraw() already clears the record; belt and braces for a page whose
+    // cookie was written on a parent domain.
+    try {
+      var h = global.location && global.location.hostname ? global.location.hostname : '';
+      var variants = ['', h ? '; domain=' + h : '', h ? '; domain=.' + h : ''];
+      var labels = h ? h.split('.') : [];
+      if (labels.length > 2) { variants.push('; domain=.' + labels.slice(-2).join('.')); }
+      for (var i = 0; i < variants.length; i++) {
+        doc.cookie = 'ck_consent=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/' + variants[i];
+      }
+    } catch (e) { /* noop */ }
+    lsDel('ck_consent');
+    try { global.location.reload(); } catch (e) { /* noop */ }
+  }
+
+  function showBanner() {
+    // Non-destructive on purpose: this opens the preferences panel and leaves
+    // the stored decision alone. Erasing consent is the other button's job, and
+    // on a live site a "show banner" click must never wipe the owner's record.
+    try { if (CK && CK.show) { CK.show(); } } catch (e) { /* noop */ }
+    schedule();
+  }
+
+  function copyReport(btn) {
+    var text = '';
+    try { text = JSON.stringify(buildReport(reportInput()), null, 2); } catch (e) { text = '{}'; }
+    var done = function (ok) {
+      try {
+        btn.textContent = ok ? T.copied : T.copyFailed;
+        global.setTimeout(function () { btn.textContent = T.copy; }, 1500);
+      } catch (e2) { /* noop */ }
+    };
+    try {
+      if (global.navigator && global.navigator.clipboard && global.navigator.clipboard.writeText) {
+        global.navigator.clipboard.writeText(text).then(function () { done(true); },
+          function () { done(fallbackCopy(text)); });
+        return;
+      }
+    } catch (e) { /* noop */ }
+    done(fallbackCopy(text));
+  }
+
+  function fallbackCopy(text) {
+    try {
+      var ta = doc.createElement('textarea');
+      ta.value = text;
+      ta.setAttribute('style', 'position:fixed;top:-9999px;left:-9999px');
+      doc.body.appendChild(ta);
+      ta.select();
+      var ok = doc.execCommand ? doc.execCommand('copy') : false;
+      doc.body.removeChild(ta);
+      return !!ok;
+    } catch (e) { return false; }
+  }
+
+  // ---------------------------------------------------------------------------
+  // Mount
+  // ---------------------------------------------------------------------------
+  // The banner's bar layout sits at bottom:16 across the full width and the UI's
+  // floating button at bottom-left; lift the panel above whatever is at the
+  // bottom right now so its buttons stay clickable.
+  function avoidBanner() {
+    if (!host) { return; }
+    var bottom = 12;
+    try {
+      var ckRoot = doc.getElementById('ck-root');
+      var sr = ckRoot && ckRoot.shadowRoot;
+      // The bar spans the width at bottom:16; the box-right card sits exactly
+      // where this panel does. Both must be cleared (the UI's floating button
+      // is bottom-left and never collides).
+      var banner = sr && sr.querySelector(
+        '.ck-banner--bar.ck-pos-bottom, .ck-banner--box.ck-pos-bottom-right');
+      if (banner && banner.getBoundingClientRect) {
+        var r = banner.getBoundingClientRect();
+        if (r.height > 0 && r.bottom > (global.innerHeight || 0) - r.height - 40) {
+          bottom = Math.round(r.height) + 24;
+        }
+      }
+    } catch (e) { /* noop */ }
+    try { host.style.bottom = bottom + 'px'; } catch (e2) { /* noop */ }
+  }
+
+  function mount() {
+    if (host || !doc.body) { return; }
+    // A page can carry the loader (inline block) AND a manual <script> tag for
+    // the panel: the second copy must not mount a second panel.
+    if (doc.querySelector('ck-debug')) { return; }
+    refreshLang();
+    host = doc.createElement('ck-debug');
+    host.setAttribute('aria-live', 'off');
+    root = host.attachShadow ? host.attachShadow({ mode: 'open' }) : null;
+    if (!root) { host = null; return; }
+
+    var style = doc.createElement('style');
+    style.textContent = CSS;
+    root.appendChild(style);
+
+    var wrap = el('div', { class: 'w', role: 'region', 'aria-label': T.regionLabel });
+    var head = el('div', { class: 'hd' });
+    head.appendChild(el('b', null, 'ConsentKit debug'));
+    head.appendChild(el('span', { class: 'sp' }));
+
+    toggleBtn = el('button', { type: 'button', 'aria-expanded': 'true' }, T.collapse);
+    toggleBtn.addEventListener('click', function () {
+      collapsed = !collapsed;
+      body.hidden = collapsed;
+      toggleBtn.textContent = collapsed ? T.expand : T.collapse;
+      toggleBtn.setAttribute('aria-expanded', collapsed ? 'false' : 'true');
+      if (!collapsed) { schedule(); }
+    });
+    head.appendChild(toggleBtn);
+
+    var closeBtn = el('button', { type: 'button', 'aria-label': T.closeLabel }, '×');
+    closeBtn.addEventListener('click', function () {
+      lsDel(LS_KEY);
+      try { host.parentNode.removeChild(host); } catch (e) { /* noop */ }
+      host = null;
+      API.active = false;
+    });
+    head.appendChild(closeBtn);
+
+    wrap.appendChild(head);
+    body = el('div', { class: 'bd' });
+    wrap.appendChild(body);
+    root.appendChild(wrap);
+    doc.body.appendChild(host);
+
+    render();
+    avoidBanner();
+  }
+
+  function boot() {
+    seedConsentTime();
+    stampOnDecision();
+    collectResources();
+    watchDataLayer();
+    mount();
+
+    try {
+      doc.addEventListener('ck:change', function () {
+        // Fallback for a decision made through some other path than
+        // accept()/rejectAll() (a host page calling into the core directly).
+        // stampOnDecision() has usually set this already, and its stamp is the
+        // accurate one — do not overwrite it here: entry.startTime is on the
+        // performance clock, and by now the revived scripts have already run.
+        try {
+          var st = CK && CK.getState ? CK.getState() : null;
+          if (st && st.decided) { if (consentAtMs === null) { consentAtMs = nowMs(); } }
+          else { consentAtMs = null; }
+        } catch (e2) { /* noop */ }
+        schedule();
+        global.setTimeout(avoidBanner, 60);
+      }, false);
+      doc.addEventListener('ck:init', function () { schedule(); global.setTimeout(avoidBanner, 60); }, false);
+    } catch (e) { /* noop */ }
+
+    // Late trackers and revived scripts keep arriving after the first render.
+    try { global.setInterval(schedule, 3000); } catch (e) { /* noop */ }
+    try { global.addEventListener('resize', avoidBanner, false); } catch (e) { /* noop */ }
+  }
+
+  try {
+    if (doc.readyState === 'loading') {
+      doc.addEventListener('DOMContentLoaded', function () { try { boot(); } catch (e) { /* noop */ } }, false);
+    } else { boot(); }
+  } catch (e) { /* noop */ }
+})(typeof window !== 'undefined' ? window : (typeof globalThis !== 'undefined' ? globalThis : this));