@ecomconsult/consentkit 0.5.12 → 0.5.14

package/README.md

@@ -29,7 +29,7 @@ Vanilla ES2020, zero dependencies, no build step.
 - **Equal-weight buttons, no pre-ticked boxes** — the consent invariants are
   fixed by design, see [CONTRIBUTING.md](https://github.com/vermoh/ConsentKit/blob/main/CONTRIBUTING.md)
 
-> **Status: prototype (v0.5.12).** The core, the UI and the demo are verified in
+> **Status: prototype (v0.5.14).** The core, the UI and the demo are verified in
 > a browser and covered by an automated suite (`npm test`); several distribution
 > paths are not yet tested against live systems. See
 > [Project status](#project-status) before shipping this to production.
@@ -819,19 +819,19 @@ external requests. Rebuild them with `tools/build-inline.mjs` (see
 [`tools/README.md`](https://github.com/vermoh/ConsentKit/blob/main/tools/README.md)); each block's header records the exact
 command that produced it.
 
-ConsentKit 0.5.12, rebuilt 2026-09-07, uncompressed — gzip on the server cuts
+ConsentKit 0.5.14, rebuilt 2026-09-07, uncompressed — gzip on the server cuts
 this roughly threefold. Every block includes the branding extension and the
 attribution line; `--no-branding` drops both the code and the config and takes
 **~26 KB** back off:
 
 | Block | Languages | Bytes | gzip | `--no-branding` |
 |---|---|---|---|---|
-| `ready/en-bar.txt` | en | 264,816 | 82,798 | 238,438 |
-| `ready/ru-bar.txt` | ru, ro, en | 266,806 | 83,673 | 240,242 |
-| `ready/ru-box.txt` | ru, ro, en | 266,821 | 83,682 | 240,257 |
-| `ready/ru-box-right.txt` | ru, ro, en | 266,830 | 83,687 | 240,266 |
-| `ready/ru-modal.txt` | ru, ro, en | 266,814 | 83,679 | 240,250 |
-| `ready/eu-bar.txt` | 34 languages | 315,460 | 101,998 | 288,916 |
+| `ready/en-bar.txt` | en | 275,509 | 86,249 | 249,096 |
+| `ready/ru-bar.txt` | ru, ro, en | 277,578 | 87,146 | 250,979 |
+| `ready/ru-box.txt` | ru, ro, en | 277,593 | 87,156 | 250,994 |
+| `ready/ru-box-right.txt` | ru, ro, en | 277,602 | 87,161 | 250,997 |
+| `ready/ru-modal.txt` | ru, ro, en | 277,586 | 87,153 | 250,985 |
+| `ready/eu-bar.txt` | 34 languages | 326,232 | 105,534 | 299,653 |
 
 The blocks are dominated by the core and the UI (roughly 97 KB and 129 KB of
 source respectively, comments included — the builder concatenates the sources
@@ -1023,6 +1023,27 @@ Client versions. The WordPress plugin tracks the same numbers and keeps its own
 notes in
 [`plugins/wordpress/consentkit/readme.txt`](https://github.com/vermoh/ConsentKit/blob/main/plugins/wordpress/consentkit/readme.txt).
 
+### 0.5.14
+
+- **The loader tolerates a second snippet with a dead site id.** A page that
+  carries two `data-ck-id` blocks — a migration that left the old one in place —
+  is driven by the snippet whose config loads; the failing one only warns. The
+  strict fallback is raised solely when *every* snippet fails, never while
+  another is still in flight. The same id twice (Tilda duplicates the head
+  block) initialises once and warns about nothing.
+- **A second copy of the script on the same page no longer replaces the first.**
+  Each snippet loads the whole bundle, so a two-snippet page ran the client
+  twice: the second core published a fresh, uninitialised engine over
+  `window.ConsentKit` and the second UI layer mounted its own banner, leaving
+  the real config applied to an engine nothing pointed at any more — a banner
+  drawn from the built-in defaults. The second copy now stands down: the first
+  engine keeps its state, its DOM patches and its observer, and the page mounts
+  exactly one banner.
+
+### 0.5.13
+
+- Host database: `fbcdn.net` → marketing (Facebook SDK chunks and plugin images); `aichat.md`, `bubble.aichat.md` → functional (chat widget); `challenges.cloudflare.com` (Cloudflare challenge / Turnstile) and `i.imgur.com` → infrastructure, never held.
+
 ### 0.5.12
 - **Services in the preferences panel are collapsed by default and compact.**
   The group's «N services · M cookies» line became a disclosure button; opening
@@ -1139,7 +1160,7 @@ notes in
 
 ## Project status
 
-**This is a prototype (v0.5.12), not a released product.** It is honest about
+**This is a prototype (v0.5.14), not a released product.** It is honest about
 what has been verified and what has not.
 
 ### Verified

package/npm/internal-stub.mjs

@@ -28,7 +28,7 @@ export function undecidedState() {
  */
 export function createStub() {
   const stub = {
-    version: '0.5.12',
+    version: '0.5.14',
     config: {},
     init: function () { return undecidedState(); },
     allowed: function (cat) { return cat === 'necessary'; },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ecomconsult/consentkit",
-  "version": "0.5.12",
+  "version": "0.5.14",
   "description": "GDPR cookie consent core with blocking engine, Shadow DOM UI and Google Consent Mode v2. Zero dependencies, no build step.",
   "repository": {
     "type": "git",

package/src/ck-core.js

@@ -9,6 +9,29 @@
   'use strict';
 
   if (!global) { return; }
+
+  /* SPEC §1.9 — a second copy of ck.js on the page stands down.
+     A page can carry two snippets: an old page-level block with a dead site id
+     that nobody ever removed, plus the site-wide one. Each <script> loads the
+     WHOLE bundle, so this file runs twice — and without this guard the second
+     run would publish a fresh, uninitialised engine over `window.ConsentKit`.
+     Everything the first engine did stays behind on an object nothing points at
+     any more: its consent state, and the loader that is mid-fetch holding a
+     `CK` reference to it. The page would then end on the default config with a
+     banner drawn from default texts, while the real config was applied to the
+     orphan.
+     Standing down here is also what the two loaders' arbitration in ck-saas.js
+     assumes: `__ckSaas` coordinates them on the premise that both are talking
+     to the SAME core, so `shared.done` genuinely means "this page is
+     initialised" rather than "some object was initialised".
+     The patches, the MutationObserver and the initial scan are already live
+     from the first run; re-installing them would double every interception.
+     `init` is the test rather than mere presence, because ck-ui-branding.js
+     pre-creates a bare `window.ConsentKit = {}` when it happens to load first.
+     That object has no `init`, so we fall through and publish over it exactly
+     as before. */
+  if (global.ConsentKit && typeof global.ConsentKit.init === 'function') { return; }
+
   var doc = global.document;
 
   // ---------------------------------------------------------------------------
@@ -92,6 +115,7 @@
 
     // --- marketing -----------------------------------------------------
     'connect.facebook.net': 'marketing',
+    'fbcdn.net': 'marketing',                 // Facebook CDN: SDK chunks (static.xx) and plugin images (scontent.*)
     'facebook.net': 'marketing',              // connect.facebook.net covered above
     'analytics.tiktok.com': 'marketing',
     'googleadservices.com': 'marketing',
@@ -205,6 +229,7 @@
     // Booking and form embeds — the visitor came to the page to use them.
     'calendly.com': 'functional',
     'typeform.com': 'functional',
+    'aichat.md': 'functional',                // aichat.md chat widget (bubble.aichat.md loader)
     // 999.md — the Moldovan classifieds platform. Shops embed its listing
     // widgets; simpalsmedia.com is the group's asset host that serves them.
     '999.md': 'functional',
@@ -432,6 +457,9 @@
   // places is classified, not waved through — so a bare `cloudflare.com` here
   // would be a bug.
   var INFRA_DB = [
+    // --- bot checks and image hosts: not a consent decision -------------
+    'challenges.cloudflare.com',           // Cloudflare challenge / Turnstile (incl. *.challenges.cloudflare.com)
+    'i.imgur.com',                          // hot-linked images
     // --- site builders and hosting platforms ---------------------------
     'tildacdn.com',
     'tildacdn.net',
@@ -1973,7 +2001,7 @@
   // Public API
   // ---------------------------------------------------------------------------
   var ConsentKit = {
-    version: '0.5.12',
+    version: '0.5.14',
     config: config,
 
     init: function (userConfig) {

package/src/ck-debug.js

@@ -272,6 +272,7 @@
       source: 'источник',
       srcSaas: 'SaaS',
       srcInline: 'инлайн',
+      twoSnippets: 'два снипета',
       secConsent: 'Согласие',
       decidedAt: 'решение',
       method: 'способ',
@@ -348,6 +349,7 @@
       source: 'source',
       srcSaas: 'SaaS',
       srcInline: 'inline',
+      twoSnippets: 'two snippets',
       secConsent: 'Consent',
       decidedAt: 'decided',
       method: 'method',
@@ -423,6 +425,7 @@
       source: 'sursă',
       srcSaas: 'SaaS',
       srcInline: 'inline',
+      twoSnippets: 'două fragmente',
       secConsent: 'Consimțământ',
       decidedAt: 'decizie',
       method: 'mod',
@@ -910,14 +913,26 @@
     body.textContent = '';
 
     // 1. Client
+    /* Read straight off _saas rather than through buildReport(): more than one
+       snippet on a page is a fact about the page, not about the report, and it
+       is worth surfacing because the symptom it explains — a banner configured
+       by an id the owner did not expect — is otherwise invisible. */
+    var siteIds = null;
+    try {
+      var ids = CK && CK._saas && CK._saas.siteIds;
+      if (ids && ids.length > 1) { siteIds = ids.join(', '); }
+    } catch (e) { siteIds = null; }
+
     var s1 = section(T.secClient);
-    s1.appendChild(defs([
+    var rows1 = [
       [T.version, r.client.version],
       [T.source, r.client.source === 'saas' ? T.srcSaas : T.srcInline],
-      ['siteId', r.client.siteId],
-      ['policyVersion', r.client.policyVersion],
-      ['ETag', r.client.etag]
-    ]));
+      ['siteId', r.client.siteId]
+    ];
+    if (siteIds) { rows1.push([T.twoSnippets, siteIds]); }
+    rows1.push(['policyVersion', r.client.policyVersion]);
+    rows1.push(['ETag', r.client.etag]);
+    s1.appendChild(defs(rows1));
     body.appendChild(s1);
 
     // 2. Consent

package/src/ck-saas.js

@@ -64,11 +64,35 @@
       // document.currentScript is correct while this file is executing.
       var cur = doc.currentScript;
       if (cur && cur.getAttribute && cur.getAttribute('data-ck-id')) { return cur; }
+      // Fallback for the exotic case where currentScript is unavailable (an
+      // async injection, an old browser). With two snippets on the page both
+      // loaders would pick the same last tag — which the §1.2 stand-down below
+      // turns into "the second one goes quiet" rather than a double init. Not
+      // ideal, but it degrades in the safe direction, and every real snippet is
+      // a plain synchronous <script> where currentScript is set.
       var all = doc.querySelectorAll('script[data-ck-id]');
       return all && all.length ? all[all.length - 1] : null;
     } catch (e) { return null; }
   }
 
+  // Every distinct data-ck-id on the page, in document order. Read from the DOM
+  // rather than accumulated across loaders, because on a real page the second
+  // snippet's tag may not be parsed yet when the first loader runs — the last
+  // loader to execute sees them all, and it is the one that matters.
+  function tagIds() {
+    var out = [];
+    try {
+      var all = doc.querySelectorAll('script[data-ck-id]');
+      if (!all) { return out; }
+      for (var i = 0; i < all.length; i++) {
+        var id = '';
+        try { id = String(all[i].getAttribute('data-ck-id') || '').trim(); } catch (e2) { id = ''; }
+        if (id && out.indexOf(id) === -1) { out.push(id); }
+      }
+    } catch (e) { /* noop */ }
+    return out;
+  }
+
   var tag = findOwnTag();
   if (!tag) { return; }  // no data-ck-id -> standalone page, stay inert
 
@@ -87,6 +111,54 @@
     return;
   }
 
+  // ---------------------------------------------------------------------------
+  // Shared state across every loader on the page (SPEC §1.1)
+  // ---------------------------------------------------------------------------
+  /* A page can carry more than one snippet: a site migrated between two ids and
+     the old block was never removed, an agency pasted its own on top of the
+     client's. Each copy of this file is a separate IIFE with its own closure, so
+     the only thing they can agree on is a global.
+
+     `pending` here counts CONFIG FETCHES still in flight — deliberately not the
+     same thing as the beacon queue further down, which is also called `pending`
+     but lives in this file's closure and is what _saas.pending() reports.
+
+     `warnedDup` and `activeId` are not in the spec's field list, but the once-
+     only duplicate warning and the "driven by snippet X" message have nowhere
+     else to live: whichever loader speaks last would otherwise repeat the
+     warning, and the loser needs the winner's id. */
+  var shared = global.__ckSaas;
+  if (!shared || typeof shared !== 'object') {
+    shared = global.__ckSaas = { pending: 0, done: false, ids: [], failures: [] };
+  }
+  if (!shared.ids || typeof shared.ids.length !== 'number') { shared.ids = []; }
+  if (!shared.failures || typeof shared.failures.length !== 'number') { shared.failures = []; }
+
+  /* SPEC §1.2 — the same id twice is Tilda duplicating the head block, not two
+     snippets. It is not a misconfiguration, so it must not warn; but it must
+     also not fetch or initialise a second time, or the page would pay for two
+     config requests and CK.init() would run twice. Stand down silently, and
+     BEFORE pending++ so the vanished loader cannot hold the strict fallback
+     hostage in §1.4. */
+  if (shared.ids.indexOf(siteId) !== -1) { return; }
+  shared.ids.push(siteId);
+  shared.pending++;
+
+  var allIds = tagIds();
+  // A tag whose loader has not executed yet is still a snippet on this page.
+  for (var ai = 0; ai < shared.ids.length; ai++) {
+    if (allIds.indexOf(shared.ids[ai]) === -1) { allIds.push(shared.ids[ai]); }
+  }
+  if (allIds.length > 1 && !shared.warnedDup) {
+    shared.warnedDup = true;
+    var others = [];
+    for (var oi = 0; oi < allIds.length; oi++) {
+      if (allIds[oi] !== siteId) { others.push(allIds[oi]); }
+    }
+    warn('another ConsentKit snippet on this page uses site id ' + others.join(', ') +
+      '; keep one snippet per site');
+  }
+
   var cacheKey = CACHE_PREFIX + siteId;
   var activeConfig = null;   // config currently driving this page load
 
@@ -142,13 +214,64 @@
     } catch (e) { return 0; }
   }
 
+  /* This loader's own config attempt resolves exactly once. Both the cold path
+     and the cached path run through here, and the cached path is the reason the
+     guard exists at all: it settles SUCCESSFULLY the moment the cache is read,
+     and then starts a background revalidation whose failure must not decrement
+     `pending` a second time or push a failure the page never suffered. */
+  var settled = false;
+  function settleOk() {
+    if (settled) { return; }
+    settled = true;
+    shared.done = true;
+    shared.activeId = shared.activeId || siteId;
+    shared.pending--;
+  }
+
   function initWith(config, why) {
+    settleOk();
     activeConfig = config;
     applyHostDb(config);
     try { CK.init(config); } catch (e) { error('init() failed: ' + (e && e.message)); }
     if (why) { /* reserved for diagnostics */ }
   }
 
+  /* SPEC §1.4 — one loader's config failed. What follows depends entirely on
+     what the OTHER loaders are doing, which is why none of this can be decided
+     locally.
+
+     The case that motivates the whole section: a site has a live snippet and a
+     dead one (an id that was deleted from the account). Before 0.5.14 the dead
+     one's 404 raised the strict fallback and re-initialised the core with
+     everything denied — a working banner replaced by a broken one because of a
+     block nobody had noticed in years. Now the dead snippet only fails; the
+     live snippet still drives the page. */
+  function settleFail(reason) {
+    if (settled) { return; }
+    settled = true;
+    shared.pending--;
+    shared.failures.push(siteId + ': ' + reason);
+
+    if (shared.done) {
+      // Someone else already initialised the page. Touching CK.init() now would
+      // swap ConsentKit.config identity out from under a banner the visitor may
+      // already be looking at.
+      warn('config for ' + siteId + ' unavailable (' + reason + '); the page is driven by snippet ' +
+        (shared.activeId || 'unknown'));
+      return;
+    }
+    if (shared.pending > 0) {
+      // SPEC §1.5: the strict fallback is a last resort, and it is not the last
+      // resort while another snippet may still succeed. CFG_TIMEOUT_MS bounds
+      // that wait — every in-flight fetch aborts by then, so this cannot hang.
+      warn('config for ' + siteId + ' unavailable (' + reason + '); waiting for the other snippet');
+      return;
+    }
+    // Every snippet on the page failed. This is the 0.5.13 behaviour, and for a
+    // single tag the joined list is exactly one entry.
+    initStrict(shared.failures.join('; '));
+  }
+
   // Strict FALLBACK: banner shows, every opt-in category stays off, no journal.
   // policyVersion 'strict-fallback' deliberately mismatches any stored consent,
   // so a previous decision is not silently reused when the server is unreachable.
@@ -161,13 +284,28 @@
   // Known trackers are still blocked, as always.
   function initStrict(reason) {
     warn('config unavailable (' + reason + ') — strict fallback: banner shown, all opt-in categories denied, journal disabled.');
+    shared.strictFallback = true;
+    // A _saas already published by another loader must learn this too: the
+    // object below is a plain assignment and the last loader to run wins, so a
+    // late publisher would otherwise report strictFallback: false.
+    try { if (CK._saas) { CK._saas.strictFallback = true; } } catch (e) { /* noop */ }
     initWith({ policyVersion: 'strict-fallback' });
   }
 
   // cacheMode: 'default' lets the HTTP cache answer (cold load); 'no-cache'
   // forces a conditional request to the origin (background revalidation).
   function fetchConfig(etag, cacheMode, onOk, onFail) {
-    if (typeof global.fetch !== 'function') { onFail('fetch unsupported'); return; }
+    if (typeof global.fetch !== 'function') {
+      /* Deferred to a microtask rather than called inline. Every other failure
+         path here is already asynchronous, so a synchronous one would be the
+         single case where this loader could reach the strict fallback before a
+         later snippet on the page had a chance to register itself in
+         __ckSaas.pending. A microtask, not a timer: it still resolves before
+         any network could. */
+      try { global.Promise.resolve().then(function () { onFail('fetch unsupported'); }); }
+      catch (e) { onFail('fetch unsupported'); }
+      return;
+    }
     var ctrl = null, timer = null;
     try { ctrl = new global.AbortController(); } catch (e) { ctrl = null; }
     var opts = { method: 'GET', credentials: 'omit', mode: 'cors' };
@@ -236,12 +374,13 @@
     // Cold path: no cached config exists, so the HTTP cache cannot serve a
     // stale one. Default caching is the right economy here.
     fetchConfig(null, null, function (r) {
-      if (r.notModified || !r.config) { initStrict('empty response without cache'); return; }
+      // An empty 304 without a cache to satisfy it is a failure like any other,
+      // and now goes through the same arbitration: another snippet may still be
+      // holding a usable config.
+      if (r.notModified || !r.config) { settleFail('empty response without cache'); return; }
       writeCache(r.etag, r.config);
       initWith(r.config, 'network');
-    }, function (reason) {
-      initStrict(reason);
-    });
+    }, settleFail);
   }
 
   // ---------------------------------------------------------------------------
@@ -421,10 +560,19 @@
     global.addEventListener && global.addEventListener('pagehide', flush, false);
   } catch (e) { /* noop */ }
 
-  // Minimal surface for the demo status panel; not a public API.
+  /* Minimal surface for the demo status panel; not a public API.
+
+     With two loaders this is assigned twice and the last one wins, so nothing
+     that must survive may be read out of this closure: `siteIds` comes from the
+     DOM and `strictFallback` from the shared object, both of which every loader
+     agrees on. `pending()` still reports the BEACON queue — a different counter
+     from __ckSaas.pending, and the one the demo page and the panel already
+     read. */
   CK._saas = {
     siteId: siteId,
     api: apiBase,
+    siteIds: allIds.slice(),
+    strictFallback: shared.strictFallback === true,
     pending: function () { return pending.length; },
     config: function () { return activeConfig; }
   };

package/src/ck-ui.js

@@ -5,6 +5,18 @@
 (function () {
   'use strict';
 
+  /* SPEC §1.9 — the second copy of ck.js on the page draws nothing.
+     Two snippets each load the whole bundle, so this file runs twice. Every
+     copy is its own IIFE with its own `mounted` flag, so a second copy would
+     register a second set of ck:* listeners and mount a second banner into the
+     same #ck-root — the first copy's, which it cannot see. ck-core.js stands
+     down for the same reason; this is the UI half of it.
+     SSR-safe: with no window we behave exactly as before and fall through. The
+     flag is claimed further down, after the `typeof document` guard, so a copy
+     that only ever published the pure `_contrast` helpers into a DOM-less
+     context does not lock out a later copy that could actually render. */
+  if (typeof window !== 'undefined' && window.__ckUiLoaded) { return; }
+
   var OPT_IN = ['functional', 'analytics', 'marketing'];
   var ALL_CATS = ['necessary'].concat(OPT_IN);
 
@@ -2971,6 +2983,11 @@
   // this file in Node is a no-op rather than a throw (mirrors the core).
   if (typeof document === 'undefined') return;
 
+  // Claim the page for this copy (SPEC §1.9, guard at the top of the file).
+  // Here rather than at the top: only now does this copy take ownership of the
+  // listeners and the mount, and only that ownership is worth locking.
+  try { if (typeof window !== 'undefined') { window.__ckUiLoaded = true; } } catch (e) { /* noop */ }
+
   document.addEventListener('ck:init', function (e) {
     var d = (e && e.detail) || {};
     var cfg = d.config || safeConfig();