@ecomconsult/consentkit 0.3.5 → 0.5.0

package/npm/index.mjs

@@ -3,7 +3,9 @@
  * re-exports the public API.
  *
  * Load order is contractual: ck-core.js (blocking starts at parse time) →
- * ck-locales.js (extra language packs) → ck-ui.js (Shadow DOM layer).
+ * ck-locales.js (extra language packs) → ck-ui-branding.js (optional logo /
+ * attribution extension, which must register before the UI mounts) →
+ * ck-ui.js (Shadow DOM layer).
  *
  * Only the core is DOM-optional. `src/ck-ui.js` touches `document` at module
  * scope, so it is imported dynamically behind a `typeof document` guard —
@@ -25,6 +27,13 @@ if (hasDom) {
     await import('../src/ck-locales.js');
   } catch (e) { /* locales are optional; ck-ui falls back to built-in en/ru */ }
 
+  // Optional branding extension. Before ck-ui.js on purpose: it registers
+  // itself on ConsentKit._uiExtensions and must be there before the first
+  // mount(). Absent, the UI simply draws no logo and no attribution line.
+  try {
+    await import('../src/ck-ui-branding.js');
+  } catch (e) { /* branding is optional; the UI renders without it */ }
+
   // Required in the browser, fatal in Node — hence the guard above.
   try {
     await import('../src/ck-ui.js');
@@ -42,6 +51,9 @@ export const {
   rejectAll,
   withdraw,
   show,
-  hide
+  hide,
+  // v0.4.0 (§1.3): merging service overrides into the tracker database is part
+  // of the public surface, so it must be reachable as a named import too.
+  _extendHostDb
 } = ConsentKit;
 export { ConsentKit };

package/npm/internal-stub.mjs

@@ -28,7 +28,7 @@ export function undecidedState() {
  */
 export function createStub() {
   const stub = {
-    version: '0.3.5',
+    version: '0.5.0',
     config: {},
     init: function () { return undecidedState(); },
     allowed: function (cat) { return cat === 'necessary'; },
@@ -39,6 +39,17 @@ export function createStub() {
     show: function () {},
     hide: function () {},
     _categories: CATEGORIES.slice(),
+    // v0.4.0: the stub mirrors the real surface, so consumer code that calls
+    // these needs no branching when the core failed to attach.
+    _extendHostDb: function () { return 0; },
+    _baseAllow: [],
+    _categoryForUrl: function () { return null; },
+    // v0.4.1 (§8): the infrastructure list. Empty here for the same reason
+    // _baseAllow is — a stub means the engine never attached, so it is not
+    // letting anything through and must not claim a list it does not enforce.
+    _infra: function () { return []; },
+    _isInfra: function () { return false; },
+    _blocked: function () { return []; },
     _isStub: true
   };
   return stub;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ecomconsult/consentkit",
-  "version": "0.3.5",
+  "version": "0.5.0",
   "description": "GDPR cookie consent core with blocking engine, Shadow DOM UI and Google Consent Mode v2. Zero dependencies, no build step.",
   "repository": {
     "type": "git",