@ecomconsult/consentkit 0.5.13 → 0.5.15

package/README.md

@@ -29,7 +29,7 @@ Vanilla ES2020, zero dependencies, no build step.
 - **Equal-weight buttons, no pre-ticked boxes** — the consent invariants are
   fixed by design, see [CONTRIBUTING.md](https://github.com/vermoh/ConsentKit/blob/main/CONTRIBUTING.md)
 
-> **Status: prototype (v0.5.13).** The core, the UI and the demo are verified in
+> **Status: prototype (v0.5.15).** The core, the UI and the demo are verified in
 > a browser and covered by an automated suite (`npm test`); several distribution
 > paths are not yet tested against live systems. See
 > [Project status](#project-status) before shipping this to production.
@@ -193,6 +193,8 @@ Pass any subset to `init()`. Nested objects merge with the defaults.
 | `texts.policyUrl` | `string` | — | v0.5.0. Cookie policy address. `http(s)` only; anything else is ignored |
 | `texts.detailsAction` | `"policy" \| "settings" \| "hide" \| "declaration"` | see notes | v0.5.0, `declaration` in v0.5.7. What «Learn more» does. Defaults to `policy` when `policyUrl` is set, `settings` when it is not. `policy` or `declaration` without a usable URL falls back to `settings` rather than rendering a dead link |
 | `texts.declarationUrl` | `string` | — | v0.5.7. Address of the cookie declaration page, used by `detailsAction: "declaration"`. `http(s)` only. Filled by the hosted service; the client only reads it |
+| `texts.<lang>` | `object` | — | v0.5.15. Per-language dictionary overrides, keyed by a language tag (`ru`, `ro`, `en`, `pt-br`, …). Overridable keys: `bannerTitle`, `bannerText`, `panelTitle`, `panelIntro`, `extraTitle`, `extraText`, and `cat.<necessary\|functional\|analytics\|marketing>.title` / `.desc`. An empty string falls through to the standard text; every other key is ignored — see [Custom texts and links](#custom-texts-and-links) |
+| `texts.links` | `object[]` | `[]` | v0.5.15. Up to 3 links under the banner buttons and at the foot of the settings panel: `{ id, url, label: { ru, ro, en, … } }`. `url` is `http(s)` only; a row with no resolvable label or an unusable address is skipped. Does not affect `detailsAction`, except that «Learn more» is hidden when its `policy` / `declaration` URL repeats one of these links — see [Custom texts and links](#custom-texts-and-links) |
 | `categories.*.enabled` | `boolean` | `true` | Per category: `functional`, `analytics`, `marketing`. Hides the toggle when `false` |
 | `consentTtlDays` | `number` | `365` | Lifetime of the stored decision |
 | `integrations.gcm` | `boolean` | `true` | Google Consent Mode v2 signals |
@@ -363,10 +365,161 @@ Both link forms accept `http(s)` addresses only. A `javascript:` or `data:` URL
 in a control the visitor is invited to click is an XSS vector, so anything else
 is refused and the link degrades to `settings`.
 
+Since 0.5.15 both link forms are also dropped for a render whose `texts.links`
+already show the same address, so the banner never links one page twice — see
+[`texts.links`](#textslinks--your-own-links).
+
 > Before 0.5.0 this control was rendered as `<a href="#">` with no handler at
 > all: clicking it jumped to the top of the page and nothing else. Any site
 > running 0.4.x or earlier has a dead «Learn more» link.
 
+### Custom texts and links
+
+Since 0.5.15 the banner and the panel can carry your own words, per language,
+and up to three of your own links. This exists because a cookie banner in some
+jurisdictions has to name the operator and say where a data subject may
+complain — that is a legal requirement, not decoration, and it does not fit in
+any of the built-in sentences.
+
+#### `texts.<lang>` — dictionary overrides
+
+A key under `texts` is treated as a language dictionary when — and only when —
+it looks like a language tag, matching `/^[a-z]{2}(-[a-z]{2})?$/`. That is what
+keeps `policyUrl`, `detailsAction`, `declarationUrl` and `links` out of it; no
+scalar setting under `texts` is ever two letters.
+
+Overridable keys, and nothing else:
+
+| Key | Where it shows |
+|---|---|
+| `bannerTitle` | The banner's heading |
+| `bannerText` | The banner's paragraph |
+| `panelTitle` | The settings panel's heading |
+| `panelIntro` | The line under it |
+| `extraTitle` | Heading of the «Additional information» block (defaults to a translated «Additional information» in all 32 languages) |
+| `extraText` | Body of that block. **Empty in every dictionary** — the block renders only when you supply text |
+| `cat.<name>.title` / `.desc` | One category's name and description, for `necessary`, `functional`, `analytics`, `marketing` |
+
+Anything else — `acceptAll`, `more`, `save`, an unknown key — is ignored. The
+button labels are what a visitor recognises across sites, and the plural tables
+are arrays that a string override would break.
+
+Values are merged in three layers, in this order, each winning over the one
+before it:
+
+```
+built-in dictionary  ←  window.__ckLocales  ←  config.texts[lang]
+```
+
+For the last layer the exact resolved code is tried first, then its two-letter
+base: a banner that resolved to `pt-br` reads `texts['pt-br']`, then
+`texts['pt']`. **A non-empty string wins; an empty string, a missing key or a
+non-string falls through to the layer below.** That is what makes an empty field
+in an editor mean «use the standard text» rather than «show nothing».
+
+Every value is treated as **text, never as HTML**, everywhere.
+
+#### The markup subset for `extraText`
+
+`extraText` is the one field with structure, because an operator block genuinely
+is two or three paragraphs with an address and a link in them. The rules below
+are the whole contract — the hosted service's validator mirrors them exactly,
+so what the cabinet previews is what the banner paints:
+
+1. **Paragraphs.** A blank line (two newlines) starts a new paragraph. Each
+   paragraph becomes one `<p>`.
+2. **Line breaks.** A single newline inside a paragraph becomes a `<br>`.
+3. **Three passes, in this exact order.** The order is part of the contract,
+   not an implementation detail:
+   1. **`[label](url)` links.** Tokenised first, and their pieces are never
+      seen by the later passes. This is what stops the bare-URL rule from
+      eating the address inside `[label](https://…)`, stops the bare-e-mail
+      rule from firing inside a `mailto:` label, and leaves a `**` inside a
+      link label literal.
+   2. **`**bold**`**, over the text between those links.
+   3. **Bare addresses**, inside each bold and each plain span: a bare
+      `https://` or `http://` URL, and a bare e-mail address, each becoming its
+      own label.
+   Bold must come *before* the bare addresses, not after: `**mail@example.md**`
+   is one bold run that happens to contain an address, and linking the address
+   first would split the run and leave the asterisks visible on screen.
+4. **What the passes produce.** Every link — `[label](https://…)`,
+   `[label](mailto:…)`, a bare URL, a bare e-mail — is rendered with
+   `target="_blank" rel="noopener"`. `**bold**` becomes `<strong>`, and an
+   address inside it is bold *and* clickable. There is no nesting the other
+   way: `**` inside a `[label](…)` stays literal, because pass 1 removed the
+   whole link before pass 2 ran. An unclosed `**` is two literal asterisks,
+   never a bold tail that swallows the paragraph.
+5. **Any other scheme is not a link.** `[x](javascript:…)`, `data:`, `file:` —
+   the *whole literal* `[x](javascript:…)` is rendered as plain text, so a
+   mistake is visible to whoever wrote it rather than silently swallowed.
+6. **No HTML.** `<b>` is four characters of text. Nothing in this path goes
+   through `innerHTML`; the block is built with `createElement` and
+   `createTextNode` only. The hosted service refuses `<` in these fields
+   outright, at validation time.
+
+The block is drawn after the categories and their service lists, before the
+panel's buttons, and only when `extraText` resolves to a non-empty string.
+
+#### `texts.links` — your own links
+
+Up to three, rendered as a row under the banner's buttons (in all three
+layouts) and at the foot of the settings panel:
+
+```js
+texts: {
+  links: [
+    { id: 'privacy', url: 'https://shop.md/privacy',
+      label: { ru: 'Политика конфиденциальности', ro: 'Politica de confidențialitate', en: 'Privacy policy' } },
+    { id: 'cookies', url: 'https://shop.md/cookies',
+      label: { ru: 'Политика cookie', ro: 'Politica cookie', en: 'Cookie policy' } }
+  ]
+}
+```
+
+`url` must be `http(s)`; anything else is skipped. `label` is resolved with the
+same fallback chain as `branding.poweredBy.texts` — exact code, then the
+two-letter base, then `en` — and a row whose label resolves to nothing is
+skipped rather than rendered blank. The cap of three is applied to the rows that
+*survive* those checks, so one malformed entry never costs a good one its place.
+
+This does not touch `detailsAction`, with one exception that keeps the banner
+from printing the same address twice: when `detailsAction` resolves to `policy`
+or `declaration` and its URL matches one of the links on screen — compared
+trimmed, with a case-insensitive host and any trailing slash ignored — the
+in-text «Learn more» link is not rendered and the banner behaves as
+`detailsAction: "hide"` for that render, leaving the address to the link row,
+which also carries your own label for it. An explicit `detailsAction:
+"settings"` is unaffected: it opens the panel and has no address to duplicate.
+
+#### A worked example
+
+```json
+{
+  "language": "auto",
+  "texts": {
+    "policyUrl": "https://shop.md/privacy",
+    "ru": {
+      "bannerTitle": "Cookie на сайте INTERSTEPCOM",
+      "extraText": "Оператор: «FIRM» SRL, IDNO 1234567890123, мун. Кишинёв, ул. Примерная 1.\n\nПо вопросам обработки персональных данных пишите на **office@firm.md** — отвечаем не позднее одного месяца (ст. 12 ч. (3) Закона № 195/2024).\n\nВы вправе подать жалобу в [Национальный центр по защите персональных данных](https://datepersonale.md)."
+    },
+    "links": [
+      { "id": "privacy", "url": "https://shop.md/privacy",
+        "label": { "ru": "Политика конфиденциальности", "ro": "Politica de confidențialitate" } },
+      { "id": "cookies", "url": "https://shop.md/cookies",
+        "label": { "ru": "Политика cookie", "ro": "Politica cookie" } }
+    ]
+  }
+}
+```
+
+A Russian visitor sees the custom banner title, and a panel whose «Дополнительно»
+card carries three paragraphs: the operator's details, a bold auto-linked
+address with the statutory answering period, and a link to the supervisory
+authority. A Romanian visitor sees the standard Romanian banner title (nothing
+was overridden for `ro`), no «Informații suplimentare» card (no `ro.extraText`),
+and both links under the buttons in Romanian.
+
 ### Reopening the settings
 
 `ConsentKit.openSettings()` opens the preferences panel from anywhere on the
@@ -819,19 +972,19 @@ external requests. Rebuild them with `tools/build-inline.mjs` (see
 [`tools/README.md`](https://github.com/vermoh/ConsentKit/blob/main/tools/README.md)); each block's header records the exact
 command that produced it.
 
-ConsentKit 0.5.13, rebuilt 2026-09-07, uncompressed — gzip on the server cuts
+ConsentKit 0.5.15, rebuilt 2026-09-07, uncompressed — gzip on the server cuts
 this roughly threefold. Every block includes the branding extension and the
 attribution line; `--no-branding` drops both the code and the config and takes
 **~26 KB** back off:
 
 | Block | Languages | Bytes | gzip | `--no-branding` |
 |---|---|---|---|---|
-| `ready/en-bar.txt` | en | 264,816 | 82,798 | 238,438 |
-| `ready/ru-bar.txt` | ru, ro, en | 266,806 | 83,673 | 240,242 |
-| `ready/ru-box.txt` | ru, ro, en | 266,821 | 83,682 | 240,257 |
-| `ready/ru-box-right.txt` | ru, ro, en | 266,830 | 83,687 | 240,266 |
-| `ready/ru-modal.txt` | ru, ro, en | 266,814 | 83,679 | 240,250 |
-| `ready/eu-bar.txt` | 34 languages | 315,460 | 101,998 | 288,916 |
+| `ready/en-bar.txt` | en | 275,509 | 86,249 | 249,096 |
+| `ready/ru-bar.txt` | ru, ro, en | 277,578 | 87,146 | 250,979 |
+| `ready/ru-box.txt` | ru, ro, en | 277,593 | 87,156 | 250,994 |
+| `ready/ru-box-right.txt` | ru, ro, en | 277,602 | 87,161 | 250,997 |
+| `ready/ru-modal.txt` | ru, ro, en | 277,586 | 87,153 | 250,985 |
+| `ready/eu-bar.txt` | 34 languages | 326,232 | 105,534 | 299,653 |
 
 The blocks are dominated by the core and the UI (roughly 97 KB and 129 KB of
 source respectively, comments included — the builder concatenates the sources
@@ -1023,6 +1176,47 @@ Client versions. The WordPress plugin tracks the same numbers and keeps its own
 notes in
 [`plugins/wordpress/consentkit/readme.txt`](https://github.com/vermoh/ConsentKit/blob/main/plugins/wordpress/consentkit/readme.txt).
 
+### 0.5.15
+
+- **Your own texts, per language.** `texts.<lang>` overrides the banner title
+  and copy, the panel title and intro, and any category's title or description,
+  for one language at a time. An empty field means «take the standard text», so
+  a partly filled form is not a partly blank banner — see
+  [Custom texts and links](#custom-texts-and-links).
+- **An «Additional information» block in the settings panel.** `texts.<lang>.extraText`
+  renders as a card under the categories: who the operator is, where to write,
+  how long an answer takes, where to complain. It accepts a small, precisely
+  defined markup subset — paragraphs, `**bold**`, links and auto-linked e-mail
+  addresses — and no HTML at all: the block is built with `createElement` and
+  `createTextNode`, never `innerHTML`.
+- **Up to three of your own links under the banner buttons** and at the foot of
+  the settings panel, via `texts.links`. Each carries a per-language label, is
+  `http(s)`-only, and opens with `target="_blank" rel="noopener"`. «Learn more»
+  is unaffected: a site that adds links keeps whatever `detailsAction` already
+  did — except that the in-text link is dropped when it would repeat an address
+  already on screen in the link row, so the same page is never linked twice.
+- **The debug panel reports which language got overrides**, so «I filled in the
+  text and the banner still shows the standard one» has an answer on screen —
+  usually that the override is filed under a language code the banner did not
+  resolve to.
+
+### 0.5.14
+
+- **The loader tolerates a second snippet with a dead site id.** A page that
+  carries two `data-ck-id` blocks — a migration that left the old one in place —
+  is driven by the snippet whose config loads; the failing one only warns. The
+  strict fallback is raised solely when *every* snippet fails, never while
+  another is still in flight. The same id twice (Tilda duplicates the head
+  block) initialises once and warns about nothing.
+- **A second copy of the script on the same page no longer replaces the first.**
+  Each snippet loads the whole bundle, so a two-snippet page ran the client
+  twice: the second core published a fresh, uninitialised engine over
+  `window.ConsentKit` and the second UI layer mounted its own banner, leaving
+  the real config applied to an engine nothing pointed at any more — a banner
+  drawn from the built-in defaults. The second copy now stands down: the first
+  engine keeps its state, its DOM patches and its observer, and the page mounts
+  exactly one banner.
+
 ### 0.5.13
 
 - Host database: `fbcdn.net` → marketing (Facebook SDK chunks and plugin images); `aichat.md`, `bubble.aichat.md` → functional (chat widget); `challenges.cloudflare.com` (Cloudflare challenge / Turnstile) and `i.imgur.com` → infrastructure, never held.
@@ -1143,7 +1337,7 @@ notes in
 
 ## Project status
 
-**This is a prototype (v0.5.13), not a released product.** It is honest about
+**This is a prototype (v0.5.15), not a released product.** It is honest about
 what has been verified and what has not.
 
 ### Verified

package/npm/index.d.ts

@@ -168,6 +168,40 @@ export interface CkTextsConfig {
    * service; the client only reads it.
    */
   declarationUrl?: string;
+  /**
+   * v0.5.15. Up to three links rendered under the banner buttons and at the
+   * bottom of the preferences panel. `url` is `http(s)` only; `label` is
+   * resolved per language the way `branding.poweredBy.texts` is. A link whose
+   * address equals the «Learn more» target hides the in-text link.
+   */
+  links?: CkTextLink[];
+  /**
+   * v0.5.15. Per-language overrides of the built-in dictionary, keyed by a
+   * language code (`ru`, `ro`, `en`, `pt-br`, …). An empty string means «use
+   * the dictionary». `extraText` accepts the rich-text subset documented in
+   * the README («Custom texts and links»); it is never interpreted as HTML.
+   */
+  [lang: string]: CkTextOverrides | CkTextLink[] | string | undefined;
+}
+
+/** v0.5.15. One link under the banner buttons. */
+export interface CkTextLink {
+  id: string;
+  url: string;
+  label: Record<string, string>;
+}
+
+/** v0.5.15. The dictionary keys a site may override for one language. */
+export interface CkTextOverrides {
+  bannerTitle?: string;
+  bannerText?: string;
+  panelTitle?: string;
+  panelIntro?: string;
+  /** Heading of the «Additional information» block in the preferences panel. */
+  extraTitle?: string;
+  /** Body of that block; rendered only when non-empty. Rich-text subset. */
+  extraText?: string;
+  cat?: Partial<Record<'necessary' | 'functional' | 'analytics' | 'marketing', { title?: string; desc?: string }>>;
 }
 
 /** Whether a category is offered in the preferences panel at all. */
@@ -421,7 +455,7 @@ export interface CkContrastApi {
   resolveFont(theme: CkThemeConfig): string;
   /** Takes the whole config, not just `texts`. */
   resolveDetails(config: CkConfig):
-    { kind: 'policy' | 'settings' | 'hide'; href: string | null };
+    { kind: 'policy' | 'settings' | 'hide' | 'declaration'; href: string | null };
   /** Takes the whole config. Returns the generated stylesheet and both palettes. */
   buildThemeCss(config: CkConfig): {
     css: string;

package/npm/internal-stub.mjs

@@ -28,7 +28,7 @@ export function undecidedState() {
  */
 export function createStub() {
   const stub = {
-    version: '0.5.13',
+    version: '0.5.15',
     config: {},
     init: function () { return undecidedState(); },
     allowed: function (cat) { return cat === 'necessary'; },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ecomconsult/consentkit",
-  "version": "0.5.13",
+  "version": "0.5.15",
   "description": "GDPR cookie consent core with blocking engine, Shadow DOM UI and Google Consent Mode v2. Zero dependencies, no build step.",
   "repository": {
     "type": "git",

package/src/ck-core.js

@@ -9,6 +9,29 @@
   'use strict';
 
   if (!global) { return; }
+
+  /* SPEC §1.9 — a second copy of ck.js on the page stands down.
+     A page can carry two snippets: an old page-level block with a dead site id
+     that nobody ever removed, plus the site-wide one. Each <script> loads the
+     WHOLE bundle, so this file runs twice — and without this guard the second
+     run would publish a fresh, uninitialised engine over `window.ConsentKit`.
+     Everything the first engine did stays behind on an object nothing points at
+     any more: its consent state, and the loader that is mid-fetch holding a
+     `CK` reference to it. The page would then end on the default config with a
+     banner drawn from default texts, while the real config was applied to the
+     orphan.
+     Standing down here is also what the two loaders' arbitration in ck-saas.js
+     assumes: `__ckSaas` coordinates them on the premise that both are talking
+     to the SAME core, so `shared.done` genuinely means "this page is
+     initialised" rather than "some object was initialised".
+     The patches, the MutationObserver and the initial scan are already live
+     from the first run; re-installing them would double every interception.
+     `init` is the test rather than mere presence, because ck-ui-branding.js
+     pre-creates a bare `window.ConsentKit = {}` when it happens to load first.
+     That object has no `init`, so we fall through and publish over it exactly
+     as before. */
+  if (global.ConsentKit && typeof global.ConsentKit.init === 'function') { return; }
+
   var doc = global.document;
 
   // ---------------------------------------------------------------------------
@@ -1978,7 +2001,7 @@
   // Public API
   // ---------------------------------------------------------------------------
   var ConsentKit = {
-    version: '0.5.13',
+    version: '0.5.15',
     config: config,
 
     init: function (userConfig) {

package/src/ck-debug.js

@@ -272,6 +272,7 @@
       source: 'источник',
       srcSaas: 'SaaS',
       srcInline: 'инлайн',
+      twoSnippets: 'два снипета',
       secConsent: 'Согласие',
       decidedAt: 'решение',
       method: 'способ',
@@ -311,6 +312,12 @@
       themeCard: 'карточка',
       themeBtn: 'кнопки',
       themeLink: 'Ссылки',
+      // SPEC V1.16 §1.4 — какой язык получил свои тексты из конфига. Отвечает
+      // на вопрос «почему на баннере не тот текст, который я вписал»: чаще
+      // всего потому, что переопределение записано под другим кодом языка.
+      textsOverride: 'Тексты',
+      textsFor: 'переопределения для ',
+      textsNone: 'нет',
       btnAccept: 'Принять всё',
       btnReject: 'Отклонить всё',
       btnSettings: 'Настроить',
@@ -348,6 +355,7 @@
       source: 'source',
       srcSaas: 'SaaS',
       srcInline: 'inline',
+      twoSnippets: 'two snippets',
       secConsent: 'Consent',
       decidedAt: 'decided',
       method: 'method',
@@ -385,6 +393,9 @@
       themeCard: 'card',
       themeBtn: 'buttons',
       themeLink: 'Links',
+      textsOverride: 'Texts',
+      textsFor: 'overrides for ',
+      textsNone: 'none',
       btnAccept: 'Accept all',
       btnReject: 'Reject all',
       btnSettings: 'Customize',
@@ -423,6 +434,7 @@
       source: 'sursă',
       srcSaas: 'SaaS',
       srcInline: 'inline',
+      twoSnippets: 'două fragmente',
       secConsent: 'Consimțământ',
       decidedAt: 'decizie',
       method: 'mod',
@@ -460,6 +472,9 @@
       themeCard: 'card',
       themeBtn: 'butoane',
       themeLink: 'Linkuri',
+      textsOverride: 'Texte',
+      textsFor: 'suprascrieri pentru ',
+      textsNone: 'niciuna',
       btnAccept: 'Acceptă tot',
       btnReject: 'Respinge tot',
       btnSettings: 'Personalizează',
@@ -850,6 +865,45 @@
                 : 'inherit (' + T.themeFontInherit + tries + ')';
   }
 
+  /* SPEC V1.16 §1.4 — «Тексты: переопределения для ru» / «нет».
+
+     The question this answers is «I filled the banner text in the cabinet and
+     the banner still shows the standard one». Nine times in ten the answer is
+     that the override is filed under a language code the banner did not resolve
+     to — so the row reports the RESOLVED code, not the configured one, and says
+     which of the two lookups (exact, then two-letter base) actually hit.
+
+     The resolution is asked of ck-ui through _contrast rather than repeated
+     here: «один код — одни числа», the same rule the Appearance section above
+     already follows. With ck-ui absent (a core-only page) there is no banner
+     language to report and the row reads «нет». */
+  function textsRow(T) {
+    var cfg = (CK && CK.config) || {};
+    var texts = (cfg.texts && typeof cfg.texts === 'object' && !Array.isArray(cfg.texts))
+      ? cfg.texts : null;
+    if (!texts) return T.textsNone;
+    var lang = '';
+    try {
+      var C = CK && CK._contrast;
+      if (C && typeof C.resolveLang === 'function' && typeof C.localeTable === 'function') {
+        lang = String(C.resolveLang(cfg.language, C.localeTable()) || '').toLowerCase();
+      }
+    } catch (e) { lang = ''; }
+    if (!lang) return T.textsNone;
+
+    function has(k) {
+      return !!(k && /^[a-z]{2}(-[a-z]{2})?$/.test(k) &&
+        Object.prototype.hasOwnProperty.call(texts, k) &&
+        texts[k] && typeof texts[k] === 'object' && !Array.isArray(texts[k]));
+    }
+    // The exact code first, then its two-letter base — the same order
+    // buildStrings() merges them in, so the row names the key that actually won.
+    if (has(lang)) return T.textsFor + lang;
+    var base = lang.slice(0, 2);
+    if (base !== lang && has(base)) return T.textsFor + base;
+    return T.textsNone;
+  }
+
   // Resolved lazily, not at parse time: this file runs before ConsentKit.init()
   // has merged the site's config, so asking for the language now would always
   // read the built-in default. Re-resolved on every render so a page that
@@ -910,14 +964,26 @@
     body.textContent = '';
 
     // 1. Client
+    /* Read straight off _saas rather than through buildReport(): more than one
+       snippet on a page is a fact about the page, not about the report, and it
+       is worth surfacing because the symptom it explains — a banner configured
+       by an id the owner did not expect — is otherwise invisible. */
+    var siteIds = null;
+    try {
+      var ids = CK && CK._saas && CK._saas.siteIds;
+      if (ids && ids.length > 1) { siteIds = ids.join(', '); }
+    } catch (e) { siteIds = null; }
+
     var s1 = section(T.secClient);
-    s1.appendChild(defs([
+    var rows1 = [
       [T.version, r.client.version],
       [T.source, r.client.source === 'saas' ? T.srcSaas : T.srcInline],
-      ['siteId', r.client.siteId],
-      ['policyVersion', r.client.policyVersion],
-      ['ETag', r.client.etag]
-    ]));
+      ['siteId', r.client.siteId]
+    ];
+    if (siteIds) { rows1.push([T.twoSnippets, siteIds]); }
+    rows1.push(['policyVersion', r.client.policyVersion]);
+    rows1.push(['ETag', r.client.etag]);
+    s1.appendChild(defs(rows1));
     body.appendChild(s1);
 
     // 2. Consent
@@ -1061,7 +1127,9 @@
           [T.themeFont, fontRow(built, T)],
           [T.themeRadius, T.themeCard + ' ' + built.radius.card + 'px · ' +
             T.themeBtn + ' ' + built.radius.button + 'px'],
-          [T.themeLink, lkTxt]
+          [T.themeLink, lkTxt],
+          // SPEC V1.16 §1.4 — «Тексты: переопределения для ru» / «нет».
+          [T.textsOverride, textsRow(T)]
         ]));
 
         var labels = { accept: T.btnAccept, reject: T.btnReject, settings: T.btnSettings };