@ecomconsult/consentkit 0.5.14 → 0.5.15

package/README.md

@@ -29,7 +29,7 @@ Vanilla ES2020, zero dependencies, no build step.
 - **Equal-weight buttons, no pre-ticked boxes** — the consent invariants are
   fixed by design, see [CONTRIBUTING.md](https://github.com/vermoh/ConsentKit/blob/main/CONTRIBUTING.md)
 
-> **Status: prototype (v0.5.14).** The core, the UI and the demo are verified in
+> **Status: prototype (v0.5.15).** The core, the UI and the demo are verified in
 > a browser and covered by an automated suite (`npm test`); several distribution
 > paths are not yet tested against live systems. See
 > [Project status](#project-status) before shipping this to production.
@@ -193,6 +193,8 @@ Pass any subset to `init()`. Nested objects merge with the defaults.
 | `texts.policyUrl` | `string` | — | v0.5.0. Cookie policy address. `http(s)` only; anything else is ignored |
 | `texts.detailsAction` | `"policy" \| "settings" \| "hide" \| "declaration"` | see notes | v0.5.0, `declaration` in v0.5.7. What «Learn more» does. Defaults to `policy` when `policyUrl` is set, `settings` when it is not. `policy` or `declaration` without a usable URL falls back to `settings` rather than rendering a dead link |
 | `texts.declarationUrl` | `string` | — | v0.5.7. Address of the cookie declaration page, used by `detailsAction: "declaration"`. `http(s)` only. Filled by the hosted service; the client only reads it |
+| `texts.<lang>` | `object` | — | v0.5.15. Per-language dictionary overrides, keyed by a language tag (`ru`, `ro`, `en`, `pt-br`, …). Overridable keys: `bannerTitle`, `bannerText`, `panelTitle`, `panelIntro`, `extraTitle`, `extraText`, and `cat.<necessary\|functional\|analytics\|marketing>.title` / `.desc`. An empty string falls through to the standard text; every other key is ignored — see [Custom texts and links](#custom-texts-and-links) |
+| `texts.links` | `object[]` | `[]` | v0.5.15. Up to 3 links under the banner buttons and at the foot of the settings panel: `{ id, url, label: { ru, ro, en, … } }`. `url` is `http(s)` only; a row with no resolvable label or an unusable address is skipped. Does not affect `detailsAction`, except that «Learn more» is hidden when its `policy` / `declaration` URL repeats one of these links — see [Custom texts and links](#custom-texts-and-links) |
 | `categories.*.enabled` | `boolean` | `true` | Per category: `functional`, `analytics`, `marketing`. Hides the toggle when `false` |
 | `consentTtlDays` | `number` | `365` | Lifetime of the stored decision |
 | `integrations.gcm` | `boolean` | `true` | Google Consent Mode v2 signals |
@@ -363,10 +365,161 @@ Both link forms accept `http(s)` addresses only. A `javascript:` or `data:` URL
 in a control the visitor is invited to click is an XSS vector, so anything else
 is refused and the link degrades to `settings`.
 
+Since 0.5.15 both link forms are also dropped for a render whose `texts.links`
+already show the same address, so the banner never links one page twice — see
+[`texts.links`](#textslinks--your-own-links).
+
 > Before 0.5.0 this control was rendered as `<a href="#">` with no handler at
 > all: clicking it jumped to the top of the page and nothing else. Any site
 > running 0.4.x or earlier has a dead «Learn more» link.
 
+### Custom texts and links
+
+Since 0.5.15 the banner and the panel can carry your own words, per language,
+and up to three of your own links. This exists because a cookie banner in some
+jurisdictions has to name the operator and say where a data subject may
+complain — that is a legal requirement, not decoration, and it does not fit in
+any of the built-in sentences.
+
+#### `texts.<lang>` — dictionary overrides
+
+A key under `texts` is treated as a language dictionary when — and only when —
+it looks like a language tag, matching `/^[a-z]{2}(-[a-z]{2})?$/`. That is what
+keeps `policyUrl`, `detailsAction`, `declarationUrl` and `links` out of it; no
+scalar setting under `texts` is ever two letters.
+
+Overridable keys, and nothing else:
+
+| Key | Where it shows |
+|---|---|
+| `bannerTitle` | The banner's heading |
+| `bannerText` | The banner's paragraph |
+| `panelTitle` | The settings panel's heading |
+| `panelIntro` | The line under it |
+| `extraTitle` | Heading of the «Additional information» block (defaults to a translated «Additional information» in all 32 languages) |
+| `extraText` | Body of that block. **Empty in every dictionary** — the block renders only when you supply text |
+| `cat.<name>.title` / `.desc` | One category's name and description, for `necessary`, `functional`, `analytics`, `marketing` |
+
+Anything else — `acceptAll`, `more`, `save`, an unknown key — is ignored. The
+button labels are what a visitor recognises across sites, and the plural tables
+are arrays that a string override would break.
+
+Values are merged in three layers, in this order, each winning over the one
+before it:
+
+```
+built-in dictionary  ←  window.__ckLocales  ←  config.texts[lang]
+```
+
+For the last layer the exact resolved code is tried first, then its two-letter
+base: a banner that resolved to `pt-br` reads `texts['pt-br']`, then
+`texts['pt']`. **A non-empty string wins; an empty string, a missing key or a
+non-string falls through to the layer below.** That is what makes an empty field
+in an editor mean «use the standard text» rather than «show nothing».
+
+Every value is treated as **text, never as HTML**, everywhere.
+
+#### The markup subset for `extraText`
+
+`extraText` is the one field with structure, because an operator block genuinely
+is two or three paragraphs with an address and a link in them. The rules below
+are the whole contract — the hosted service's validator mirrors them exactly,
+so what the cabinet previews is what the banner paints:
+
+1. **Paragraphs.** A blank line (two newlines) starts a new paragraph. Each
+   paragraph becomes one `<p>`.
+2. **Line breaks.** A single newline inside a paragraph becomes a `<br>`.
+3. **Three passes, in this exact order.** The order is part of the contract,
+   not an implementation detail:
+   1. **`[label](url)` links.** Tokenised first, and their pieces are never
+      seen by the later passes. This is what stops the bare-URL rule from
+      eating the address inside `[label](https://…)`, stops the bare-e-mail
+      rule from firing inside a `mailto:` label, and leaves a `**` inside a
+      link label literal.
+   2. **`**bold**`**, over the text between those links.
+   3. **Bare addresses**, inside each bold and each plain span: a bare
+      `https://` or `http://` URL, and a bare e-mail address, each becoming its
+      own label.
+   Bold must come *before* the bare addresses, not after: `**mail@example.md**`
+   is one bold run that happens to contain an address, and linking the address
+   first would split the run and leave the asterisks visible on screen.
+4. **What the passes produce.** Every link — `[label](https://…)`,
+   `[label](mailto:…)`, a bare URL, a bare e-mail — is rendered with
+   `target="_blank" rel="noopener"`. `**bold**` becomes `<strong>`, and an
+   address inside it is bold *and* clickable. There is no nesting the other
+   way: `**` inside a `[label](…)` stays literal, because pass 1 removed the
+   whole link before pass 2 ran. An unclosed `**` is two literal asterisks,
+   never a bold tail that swallows the paragraph.
+5. **Any other scheme is not a link.** `[x](javascript:…)`, `data:`, `file:` —
+   the *whole literal* `[x](javascript:…)` is rendered as plain text, so a
+   mistake is visible to whoever wrote it rather than silently swallowed.
+6. **No HTML.** `<b>` is four characters of text. Nothing in this path goes
+   through `innerHTML`; the block is built with `createElement` and
+   `createTextNode` only. The hosted service refuses `<` in these fields
+   outright, at validation time.
+
+The block is drawn after the categories and their service lists, before the
+panel's buttons, and only when `extraText` resolves to a non-empty string.
+
+#### `texts.links` — your own links
+
+Up to three, rendered as a row under the banner's buttons (in all three
+layouts) and at the foot of the settings panel:
+
+```js
+texts: {
+  links: [
+    { id: 'privacy', url: 'https://shop.md/privacy',
+      label: { ru: 'Политика конфиденциальности', ro: 'Politica de confidențialitate', en: 'Privacy policy' } },
+    { id: 'cookies', url: 'https://shop.md/cookies',
+      label: { ru: 'Политика cookie', ro: 'Politica cookie', en: 'Cookie policy' } }
+  ]
+}
+```
+
+`url` must be `http(s)`; anything else is skipped. `label` is resolved with the
+same fallback chain as `branding.poweredBy.texts` — exact code, then the
+two-letter base, then `en` — and a row whose label resolves to nothing is
+skipped rather than rendered blank. The cap of three is applied to the rows that
+*survive* those checks, so one malformed entry never costs a good one its place.
+
+This does not touch `detailsAction`, with one exception that keeps the banner
+from printing the same address twice: when `detailsAction` resolves to `policy`
+or `declaration` and its URL matches one of the links on screen — compared
+trimmed, with a case-insensitive host and any trailing slash ignored — the
+in-text «Learn more» link is not rendered and the banner behaves as
+`detailsAction: "hide"` for that render, leaving the address to the link row,
+which also carries your own label for it. An explicit `detailsAction:
+"settings"` is unaffected: it opens the panel and has no address to duplicate.
+
+#### A worked example
+
+```json
+{
+  "language": "auto",
+  "texts": {
+    "policyUrl": "https://shop.md/privacy",
+    "ru": {
+      "bannerTitle": "Cookie на сайте INTERSTEPCOM",
+      "extraText": "Оператор: «FIRM» SRL, IDNO 1234567890123, мун. Кишинёв, ул. Примерная 1.\n\nПо вопросам обработки персональных данных пишите на **office@firm.md** — отвечаем не позднее одного месяца (ст. 12 ч. (3) Закона № 195/2024).\n\nВы вправе подать жалобу в [Национальный центр по защите персональных данных](https://datepersonale.md)."
+    },
+    "links": [
+      { "id": "privacy", "url": "https://shop.md/privacy",
+        "label": { "ru": "Политика конфиденциальности", "ro": "Politica de confidențialitate" } },
+      { "id": "cookies", "url": "https://shop.md/cookies",
+        "label": { "ru": "Политика cookie", "ro": "Politica cookie" } }
+    ]
+  }
+}
+```
+
+A Russian visitor sees the custom banner title, and a panel whose «Дополнительно»
+card carries three paragraphs: the operator's details, a bold auto-linked
+address with the statutory answering period, and a link to the supervisory
+authority. A Romanian visitor sees the standard Romanian banner title (nothing
+was overridden for `ro`), no «Informații suplimentare» card (no `ro.extraText`),
+and both links under the buttons in Romanian.
+
 ### Reopening the settings
 
 `ConsentKit.openSettings()` opens the preferences panel from anywhere on the
@@ -819,7 +972,7 @@ external requests. Rebuild them with `tools/build-inline.mjs` (see
 [`tools/README.md`](https://github.com/vermoh/ConsentKit/blob/main/tools/README.md)); each block's header records the exact
 command that produced it.
 
-ConsentKit 0.5.14, rebuilt 2026-09-07, uncompressed — gzip on the server cuts
+ConsentKit 0.5.15, rebuilt 2026-09-07, uncompressed — gzip on the server cuts
 this roughly threefold. Every block includes the branding extension and the
 attribution line; `--no-branding` drops both the code and the config and takes
 **~26 KB** back off:
@@ -1023,6 +1176,30 @@ Client versions. The WordPress plugin tracks the same numbers and keeps its own
 notes in
 [`plugins/wordpress/consentkit/readme.txt`](https://github.com/vermoh/ConsentKit/blob/main/plugins/wordpress/consentkit/readme.txt).
 
+### 0.5.15
+
+- **Your own texts, per language.** `texts.<lang>` overrides the banner title
+  and copy, the panel title and intro, and any category's title or description,
+  for one language at a time. An empty field means «take the standard text», so
+  a partly filled form is not a partly blank banner — see
+  [Custom texts and links](#custom-texts-and-links).
+- **An «Additional information» block in the settings panel.** `texts.<lang>.extraText`
+  renders as a card under the categories: who the operator is, where to write,
+  how long an answer takes, where to complain. It accepts a small, precisely
+  defined markup subset — paragraphs, `**bold**`, links and auto-linked e-mail
+  addresses — and no HTML at all: the block is built with `createElement` and
+  `createTextNode`, never `innerHTML`.
+- **Up to three of your own links under the banner buttons** and at the foot of
+  the settings panel, via `texts.links`. Each carries a per-language label, is
+  `http(s)`-only, and opens with `target="_blank" rel="noopener"`. «Learn more»
+  is unaffected: a site that adds links keeps whatever `detailsAction` already
+  did — except that the in-text link is dropped when it would repeat an address
+  already on screen in the link row, so the same page is never linked twice.
+- **The debug panel reports which language got overrides**, so «I filled in the
+  text and the banner still shows the standard one» has an answer on screen —
+  usually that the override is filed under a language code the banner did not
+  resolve to.
+
 ### 0.5.14
 
 - **The loader tolerates a second snippet with a dead site id.** A page that
@@ -1160,7 +1337,7 @@ notes in
 
 ## Project status
 
-**This is a prototype (v0.5.14), not a released product.** It is honest about
+**This is a prototype (v0.5.15), not a released product.** It is honest about
 what has been verified and what has not.
 
 ### Verified

package/npm/index.d.ts

@@ -168,6 +168,40 @@ export interface CkTextsConfig {
    * service; the client only reads it.
    */
   declarationUrl?: string;
+  /**
+   * v0.5.15. Up to three links rendered under the banner buttons and at the
+   * bottom of the preferences panel. `url` is `http(s)` only; `label` is
+   * resolved per language the way `branding.poweredBy.texts` is. A link whose
+   * address equals the «Learn more» target hides the in-text link.
+   */
+  links?: CkTextLink[];
+  /**
+   * v0.5.15. Per-language overrides of the built-in dictionary, keyed by a
+   * language code (`ru`, `ro`, `en`, `pt-br`, …). An empty string means «use
+   * the dictionary». `extraText` accepts the rich-text subset documented in
+   * the README («Custom texts and links»); it is never interpreted as HTML.
+   */
+  [lang: string]: CkTextOverrides | CkTextLink[] | string | undefined;
+}
+
+/** v0.5.15. One link under the banner buttons. */
+export interface CkTextLink {
+  id: string;
+  url: string;
+  label: Record<string, string>;
+}
+
+/** v0.5.15. The dictionary keys a site may override for one language. */
+export interface CkTextOverrides {
+  bannerTitle?: string;
+  bannerText?: string;
+  panelTitle?: string;
+  panelIntro?: string;
+  /** Heading of the «Additional information» block in the preferences panel. */
+  extraTitle?: string;
+  /** Body of that block; rendered only when non-empty. Rich-text subset. */
+  extraText?: string;
+  cat?: Partial<Record<'necessary' | 'functional' | 'analytics' | 'marketing', { title?: string; desc?: string }>>;
 }
 
 /** Whether a category is offered in the preferences panel at all. */
@@ -421,7 +455,7 @@ export interface CkContrastApi {
   resolveFont(theme: CkThemeConfig): string;
   /** Takes the whole config, not just `texts`. */
   resolveDetails(config: CkConfig):
-    { kind: 'policy' | 'settings' | 'hide'; href: string | null };
+    { kind: 'policy' | 'settings' | 'hide' | 'declaration'; href: string | null };
   /** Takes the whole config. Returns the generated stylesheet and both palettes. */
   buildThemeCss(config: CkConfig): {
     css: string;

package/npm/internal-stub.mjs

@@ -28,7 +28,7 @@ export function undecidedState() {
  */
 export function createStub() {
   const stub = {
-    version: '0.5.14',
+    version: '0.5.15',
     config: {},
     init: function () { return undecidedState(); },
     allowed: function (cat) { return cat === 'necessary'; },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ecomconsult/consentkit",
-  "version": "0.5.14",
+  "version": "0.5.15",
   "description": "GDPR cookie consent core with blocking engine, Shadow DOM UI and Google Consent Mode v2. Zero dependencies, no build step.",
   "repository": {
     "type": "git",

package/src/ck-core.js

@@ -2001,7 +2001,7 @@
   // Public API
   // ---------------------------------------------------------------------------
   var ConsentKit = {
-    version: '0.5.14',
+    version: '0.5.15',
     config: config,
 
     init: function (userConfig) {

package/src/ck-debug.js

@@ -312,6 +312,12 @@
       themeCard: 'карточка',
       themeBtn: 'кнопки',
       themeLink: 'Ссылки',
+      // SPEC V1.16 §1.4 — какой язык получил свои тексты из конфига. Отвечает
+      // на вопрос «почему на баннере не тот текст, который я вписал»: чаще
+      // всего потому, что переопределение записано под другим кодом языка.
+      textsOverride: 'Тексты',
+      textsFor: 'переопределения для ',
+      textsNone: 'нет',
       btnAccept: 'Принять всё',
       btnReject: 'Отклонить всё',
       btnSettings: 'Настроить',
@@ -387,6 +393,9 @@
       themeCard: 'card',
       themeBtn: 'buttons',
       themeLink: 'Links',
+      textsOverride: 'Texts',
+      textsFor: 'overrides for ',
+      textsNone: 'none',
       btnAccept: 'Accept all',
       btnReject: 'Reject all',
       btnSettings: 'Customize',
@@ -463,6 +472,9 @@
       themeCard: 'card',
       themeBtn: 'butoane',
       themeLink: 'Linkuri',
+      textsOverride: 'Texte',
+      textsFor: 'suprascrieri pentru ',
+      textsNone: 'niciuna',
       btnAccept: 'Acceptă tot',
       btnReject: 'Respinge tot',
       btnSettings: 'Personalizează',
@@ -853,6 +865,45 @@
                 : 'inherit (' + T.themeFontInherit + tries + ')';
   }
 
+  /* SPEC V1.16 §1.4 — «Тексты: переопределения для ru» / «нет».
+
+     The question this answers is «I filled the banner text in the cabinet and
+     the banner still shows the standard one». Nine times in ten the answer is
+     that the override is filed under a language code the banner did not resolve
+     to — so the row reports the RESOLVED code, not the configured one, and says
+     which of the two lookups (exact, then two-letter base) actually hit.
+
+     The resolution is asked of ck-ui through _contrast rather than repeated
+     here: «один код — одни числа», the same rule the Appearance section above
+     already follows. With ck-ui absent (a core-only page) there is no banner
+     language to report and the row reads «нет». */
+  function textsRow(T) {
+    var cfg = (CK && CK.config) || {};
+    var texts = (cfg.texts && typeof cfg.texts === 'object' && !Array.isArray(cfg.texts))
+      ? cfg.texts : null;
+    if (!texts) return T.textsNone;
+    var lang = '';
+    try {
+      var C = CK && CK._contrast;
+      if (C && typeof C.resolveLang === 'function' && typeof C.localeTable === 'function') {
+        lang = String(C.resolveLang(cfg.language, C.localeTable()) || '').toLowerCase();
+      }
+    } catch (e) { lang = ''; }
+    if (!lang) return T.textsNone;
+
+    function has(k) {
+      return !!(k && /^[a-z]{2}(-[a-z]{2})?$/.test(k) &&
+        Object.prototype.hasOwnProperty.call(texts, k) &&
+        texts[k] && typeof texts[k] === 'object' && !Array.isArray(texts[k]));
+    }
+    // The exact code first, then its two-letter base — the same order
+    // buildStrings() merges them in, so the row names the key that actually won.
+    if (has(lang)) return T.textsFor + lang;
+    var base = lang.slice(0, 2);
+    if (base !== lang && has(base)) return T.textsFor + base;
+    return T.textsNone;
+  }
+
   // Resolved lazily, not at parse time: this file runs before ConsentKit.init()
   // has merged the site's config, so asking for the language now would always
   // read the built-in default. Re-resolved on every render so a page that
@@ -1076,7 +1127,9 @@
           [T.themeFont, fontRow(built, T)],
           [T.themeRadius, T.themeCard + ' ' + built.radius.card + 'px · ' +
             T.themeBtn + ' ' + built.radius.button + 'px'],
-          [T.themeLink, lkTxt]
+          [T.themeLink, lkTxt],
+          // SPEC V1.16 §1.4 — «Тексты: переопределения для ru» / «нет».
+          [T.textsOverride, textsRow(T)]
         ]));
 
         var labels = { accept: T.btnAccept, reject: T.btnReject, settings: T.btnSettings };

package/src/ck-locales.js

@@ -8,7 +8,11 @@
                  + uk tr no nb is sr ca sq mk
 
    Key set mirrors the builtin en dictionary of ck-ui.js exactly:
-   19 flat strings + cat.{necessary,functional,analytics,marketing}.{title,desc}.
+   19 flat strings + cat.{necessary,functional,analytics,marketing}.{title,desc},
+   plus `extraTitle` (SPEC V1.16 §1.2 — the heading of the «Дополнительно» card
+   in the settings panel). Its BODY, `extraText`, is deliberately not here: the
+   block renders only from what the site itself supplies, so a translated body
+   would put an empty operator card on every site that never configured one.
 
    NOTE: these translations are drafts produced for the prototype. They MUST be reviewed
    by native speakers before production use — legal wording (refusal, "always on") is the
@@ -40,6 +44,7 @@
     colPurpose: 'Цел',
     colExpiry: 'Изтича',
     floating: 'Настройки на бисквитките',
+    extraTitle: 'Допълнителна информация',
     cat: {
       necessary: { title: 'Необходими', desc: 'Нужни са, за да работи сайтът — вход, сигурност, запомняне на съгласието ви. Не могат да се изключат.' },
       functional: { title: 'Функционални', desc: 'Запомнят предпочитанията ви, например език или чат, за да не ги задавате отново.' },
@@ -68,6 +73,7 @@
     colPurpose: 'Účel',
     colExpiry: 'Platnost',
     floating: 'Nastavení cookies',
+    extraTitle: 'Doplňující informace',
     cat: {
       necessary: { title: 'Nezbytné', desc: 'Bez nich web nefunguje — přihlášení, bezpečnost, uložení vašeho souhlasu. Nelze je vypnout.' },
       functional: { title: 'Funkční', desc: 'Pamatují si vaše předvolby, třeba jazyk nebo chat, abyste je nenastavovali znovu.' },
@@ -96,6 +102,7 @@
     colPurpose: 'Formål',
     colExpiry: 'Udløber',
     floating: 'Cookieindstillinger',
+    extraTitle: 'Yderligere oplysninger',
     cat: {
       necessary: { title: 'Nødvendige', desc: 'Nødvendige for at siden virker — login, sikkerhed, hukommelse om dit samtykke. De kan ikke slås fra.' },
       functional: { title: 'Funktionelle', desc: 'Husker dine indstillinger, fx sprog eller chat, så du ikke skal vælge dem igen.' },
@@ -124,6 +131,7 @@
     colPurpose: 'Zweck',
     colExpiry: 'Laufzeit',
     floating: 'Cookie-Einstellungen',
+    extraTitle: 'Weitere Informationen',
     cat: {
       necessary: { title: 'Notwendig', desc: 'Nötig, damit die Website funktioniert — Anmeldung, Sicherheit, Speichern Ihrer Einwilligung. Sie lassen sich nicht abschalten.' },
       functional: { title: 'Funktional', desc: 'Merken sich Ihre Einstellungen, etwa Sprache oder Chat, damit Sie sie nicht erneut wählen müssen.' },
@@ -152,6 +160,7 @@
     colPurpose: 'Σκοπός',
     colExpiry: 'Λήξη',
     floating: 'Ρυθμίσεις cookies',
+    extraTitle: 'Πρόσθετες πληροφορίες',
     cat: {
       necessary: { title: 'Απαραίτητα', desc: 'Χρειάζονται για να λειτουργεί ο ιστότοπος — σύνδεση, ασφάλεια, διατήρηση της επιλογής σας. Δεν απενεργοποιούνται.' },
       functional: { title: 'Λειτουργικά', desc: 'Θυμούνται τις προτιμήσεις σας, όπως γλώσσα ή συνομιλία, ώστε να μην τις ορίζετε ξανά.' },
@@ -180,6 +189,7 @@
     colPurpose: 'Finalidad',
     colExpiry: 'Caduca',
     floating: 'Configuración de cookies',
+    extraTitle: 'Información adicional',
     cat: {
       necessary: { title: 'Necesarias', desc: 'Imprescindibles para que el sitio funcione: inicio de sesión, seguridad y memoria de su consentimiento. No se pueden desactivar.' },
       functional: { title: 'Funcionales', desc: 'Recuerdan sus preferencias, como el idioma o el chat, para que no tenga que configurarlas de nuevo.' },
@@ -208,6 +218,7 @@
     colPurpose: 'Eesmärk',
     colExpiry: 'Kehtivus',
     floating: 'Küpsiste seaded',
+    extraTitle: 'Lisateave',
     cat: {
       necessary: { title: 'Vajalikud', desc: 'Vajalikud saidi tööks — sisselogimine, turvalisus, teie nõusoleku meelespidamine. Neid ei saa välja lülitada.' },
       functional: { title: 'Funktsionaalsed', desc: 'Jätavad meelde teie eelistused, näiteks keele või vestluse, et te ei peaks neid uuesti valima.' },
@@ -236,6 +247,7 @@
     colPurpose: 'Tarkoitus',
     colExpiry: 'Voimassaolo',
     floating: 'Evästeasetukset',
+    extraTitle: 'Lisätiedot',
     cat: {
       necessary: { title: 'Välttämättömät', desc: 'Tarvitaan sivuston toimintaan: kirjautuminen, turvallisuus ja suostumuksenne muistaminen. Näitä ei voi poistaa käytöstä.' },
       functional: { title: 'Toiminnalliset', desc: 'Muistavat asetuksenne, kuten kielen tai chatin, jottei niitä tarvitse valita uudelleen.' },
@@ -264,6 +276,7 @@
     colPurpose: 'Finalité',
     colExpiry: 'Expiration',
     floating: 'Paramètres des cookies',
+    extraTitle: 'Informations complémentaires',
     cat: {
       necessary: { title: 'Nécessaires', desc: 'Indispensables au fonctionnement du site : connexion, sécurité, mémorisation de votre choix. Ils ne peuvent pas être désactivés.' },
       functional: { title: 'Fonctionnels', desc: 'Retiennent vos préférences, par exemple la langue ou le chat, pour ne pas avoir à les régler de nouveau.' },
@@ -292,6 +305,7 @@
     colPurpose: 'Cuspóir',
     colExpiry: 'Éagann',
     floating: 'Socruithe fianán',
+    extraTitle: 'Eolas breise',
     cat: {
       necessary: { title: 'Riachtanach', desc: 'Ag teastáil chun an suíomh a oibriú — logáil isteach, slándáil, do thoiliú a choinneáil. Ní féidir iad a mhúchadh.' },
       functional: { title: 'Feidhmiúil', desc: 'Coinníonn siad do roghanna, mar shampla an teanga nó an comhrá, ionas nach gá duit iad a shocrú arís.' },
@@ -320,6 +334,7 @@
     colPurpose: 'Svrha',
     colExpiry: 'Istječe',
     floating: 'Postavke kolačića',
+    extraTitle: 'Dodatne informacije',
     cat: {
       necessary: { title: 'Nužni', desc: 'Potrebni su za rad stranice — prijava, sigurnost, pamćenje vaše privole. Ne mogu se isključiti.' },
       functional: { title: 'Funkcionalni', desc: 'Pamte vaše postavke, primjerice jezik ili chat, da ih ne morate ponovno birati.' },
@@ -348,6 +363,7 @@
     colPurpose: 'Cél',
     colExpiry: 'Lejárat',
     floating: 'Sütibeállítások',
+    extraTitle: 'További információk',
     cat: {
       necessary: { title: 'Szükséges', desc: 'Az oldal működéséhez kellenek: belépés, biztonság, a hozzájárulása megjegyzése. Nem kapcsolhatók ki.' },
       functional: { title: 'Funkcionális', desc: 'Megjegyzik a beállításait, például a nyelvet vagy a chatet, hogy ne kelljen újra megadnia őket.' },
@@ -376,6 +392,7 @@
     colPurpose: 'Finalità',
     colExpiry: 'Scadenza',
     floating: 'Impostazioni dei cookie',
+    extraTitle: 'Informazioni aggiuntive',
     cat: {
       necessary: { title: 'Necessari', desc: 'Servono al funzionamento del sito: accesso, sicurezza, memoria del suo consenso. Non possono essere disattivati.' },
       functional: { title: 'Funzionali', desc: 'Ricordano le sue preferenze, come la lingua o la chat, così non deve impostarle di nuovo.' },
@@ -404,6 +421,7 @@
     colPurpose: 'Paskirtis',
     colExpiry: 'Galiojimas',
     floating: 'Slapukų nustatymai',
+    extraTitle: 'Papildoma informacija',
     cat: {
       necessary: { title: 'Būtini', desc: 'Reikalingi, kad svetainė veiktų: prisijungimas, saugumas, jūsų sutikimo įsiminimas. Jų išjungti negalima.' },
       functional: { title: 'Funkciniai', desc: 'Įsimena jūsų nustatymus, pavyzdžiui, kalbą ar pokalbius, kad jų nereikėtų nurodyti iš naujo.' },
@@ -432,6 +450,7 @@
     colPurpose: 'Nolūks',
     colExpiry: 'Derīgums',
     floating: 'Sīkdatņu iestatījumi',
+    extraTitle: 'Papildu informācija',
     cat: {
       necessary: { title: 'Nepieciešamās', desc: 'Vajadzīgas vietnes darbībai — pieteikšanās, drošība, jūsu piekrišanas saglabāšana. Tās nevar izslēgt.' },
       functional: { title: 'Funkcionālās', desc: 'Atceras jūsu iestatījumus, piemēram, valodu vai tērzēšanu, lai tie nebūtu jānorāda atkārtoti.' },
@@ -460,6 +479,7 @@
     colPurpose: 'Skop',
     colExpiry: 'Skadenza',
     floating: 'Issettjar tal-cookies',
+    extraTitle: 'Informazzjoni addizzjonali',
     cat: {
       necessary: { title: 'Meħtieġa', desc: 'Meħtieġa biex is-sit jaħdem — login, sigurtà, tifkira tal-kunsens tiegħek. Ma jistgħux jintfew.' },
       functional: { title: 'Funzjonali', desc: 'Jiftakru l-preferenzi tiegħek, bħal-lingwa jew iċ-chat, biex ma jkollokx terġa’ tissettjahom.' },
@@ -488,6 +508,7 @@
     colPurpose: 'Doel',
     colExpiry: 'Vervalt',
     floating: 'Cookie-instellingen',
+    extraTitle: 'Aanvullende informatie',
     cat: {
       necessary: { title: 'Noodzakelijk', desc: 'Nodig om de site te laten werken: inloggen, beveiliging en het onthouden van uw keuze. Ze kunnen niet uit.' },
       functional: { title: 'Functioneel', desc: 'Onthouden uw voorkeuren, zoals taal of chat, zodat u ze niet opnieuw hoeft in te stellen.' },
@@ -516,6 +537,7 @@
     colPurpose: 'Cel',
     colExpiry: 'Wygasa',
     floating: 'Ustawienia plików cookie',
+    extraTitle: 'Informacje dodatkowe',
     cat: {
       necessary: { title: 'Niezbędne', desc: 'Potrzebne, by strona działała: logowanie, bezpieczeństwo, zapamiętanie zgody. Nie można ich wyłączyć.' },
       functional: { title: 'Funkcjonalne', desc: 'Zapamiętują ustawienia, na przykład język lub czat, żeby nie trzeba było wybierać ich ponownie.' },
@@ -544,6 +566,7 @@
     colPurpose: 'Finalidade',
     colExpiry: 'Validade',
     floating: 'Definições de cookies',
+    extraTitle: 'Informações adicionais',
     cat: {
       necessary: { title: 'Necessários', desc: 'Precisos para o site funcionar: início de sessão, segurança e memória do seu consentimento. Não podem ser desativados.' },
       functional: { title: 'Funcionais', desc: 'Guardam as suas preferências, como o idioma ou o chat, para não ter de as definir outra vez.' },
@@ -572,6 +595,7 @@
     colPurpose: 'Pentru ce',
     colExpiry: 'Expiră',
     floating: 'Setări cookie-uri',
+    extraTitle: 'Informații suplimentare',
     // SPEC V1.10 §2 — заглушка встраивания. Only ro carries these here: en and
     // ru are builtin in ck-ui.js, and every other locale falls back to en.
     phText: 'Aici este conținut de la {host}. Se va încărca după acordul pentru «{cat}».',
@@ -616,6 +640,7 @@
     colPurpose: 'Účel',
     colExpiry: 'Platnosť',
     floating: 'Nastavenia cookies',
+    extraTitle: 'Doplňujúce informácie',
     cat: {
       necessary: { title: 'Nevyhnutné', desc: 'Bez nich stránka nefunguje — prihlásenie, bezpečnosť, zapamätanie vášho súhlasu. Nedajú sa vypnúť.' },
       functional: { title: 'Funkčné', desc: 'Pamätajú si vaše nastavenia, napríklad jazyk alebo chat, aby ste ich nezadávali znova.' },
@@ -644,6 +669,7 @@
     colPurpose: 'Namen',
     colExpiry: 'Poteče',
     floating: 'Nastavitve piškotkov',
+    extraTitle: 'Dodatne informacije',
     cat: {
       necessary: { title: 'Nujni', desc: 'Potrebni za delovanje spletnega mesta — prijava, varnost, pomnjenje vašega soglasja. Ni jih mogoče izklopiti.' },
       functional: { title: 'Funkcionalni', desc: 'Zapomnijo si vaše nastavitve, na primer jezik ali klepet, da jih ni treba določati znova.' },
@@ -672,6 +698,7 @@
     colPurpose: 'Syfte',
     colExpiry: 'Upphör',
     floating: 'Cookieinställningar',
+    extraTitle: 'Ytterligare information',
     cat: {
       necessary: { title: 'Nödvändiga', desc: 'Krävs för att webbplatsen ska fungera — inloggning, säkerhet, minne av ditt samtycke. De kan inte stängas av.' },
       functional: { title: 'Funktionella', desc: 'Kommer ihåg dina inställningar, till exempel språk eller chatt, så att du slipper välja igen.' },
@@ -700,6 +727,7 @@
     colPurpose: 'Мета',
     colExpiry: 'Термін',
     floating: 'Налаштування cookie',
+    extraTitle: 'Додаткова інформація',
     cat: {
       necessary: { title: 'Необхідні', desc: 'Без них сайт не працює: вхід, безпека, пам’ять про ваш вибір. Вимкнути неможливо.' },
       functional: { title: 'Функціональні', desc: 'Запам’ятовують ваші налаштування — наприклад мову або чат, — щоб ви не задавали їх знову.' },
@@ -728,6 +756,7 @@
     colPurpose: 'Amaç',
     colExpiry: 'Süre',
     floating: 'Çerez ayarları',
+    extraTitle: 'Ek bilgiler',
     cat: {
       necessary: { title: 'Zorunlu', desc: 'Sitenin çalışması için gerekli: oturum açma, güvenlik, onayınızın hatırlanması. Kapatılamazlar.' },
       functional: { title: 'İşlevsel', desc: 'Dil veya sohbet gibi tercihlerinizi hatırlar, böylece yeniden ayarlamanız gerekmez.' },
@@ -756,6 +785,7 @@
     colPurpose: 'Formål',
     colExpiry: 'Utløper',
     floating: 'Innstillinger for informasjonskapsler',
+    extraTitle: 'Tilleggsinformasjon',
     cat: {
       necessary: { title: 'Nødvendige', desc: 'Kreves for at nettstedet skal virke — innlogging, sikkerhet, minne om samtykket ditt. De kan ikke slås av.' },
       functional: { title: 'Funksjonelle', desc: 'Husker innstillingene dine, som språk eller chat, så du slipper å velge på nytt.' },
@@ -788,6 +818,7 @@
     colPurpose: 'Tilgangur',
     colExpiry: 'Gildistími',
     floating: 'Stillingar vefkaka',
+    extraTitle: 'Viðbótarupplýsingar',
     cat: {
       necessary: { title: 'Nauðsynlegar', desc: 'Nauðsynlegar til að vefurinn virki — innskráning, öryggi, að muna samþykki þitt. Ekki er hægt að slökkva á þeim.' },
       functional: { title: 'Virknivefkökur', desc: 'Muna stillingar þínar, til dæmis tungumál eða spjall, svo þú þurfir ekki að velja aftur.' },
@@ -817,6 +848,7 @@
     colPurpose: 'Сврха',
     colExpiry: 'Истиче',
     floating: 'Подешавања колачића',
+    extraTitle: 'Додатне информације',
     cat: {
       necessary: { title: 'Неопходни', desc: 'Потребни су да би сајт радио — пријава, безбедност, памћење ваше сагласности. Не могу се искључити.' },
       functional: { title: 'Функционални', desc: 'Памте ваша подешавања, на пример језик или ћаскање, да их не бисте бирали поново.' },
@@ -845,6 +877,7 @@
     colPurpose: 'Finalitat',
     colExpiry: 'Caduca',
     floating: 'Configuració de galetes',
+    extraTitle: 'Informació addicional',
     cat: {
       necessary: { title: 'Necessàries', desc: 'Calen perquè el lloc funcioni: inici de sessió, seguretat i memòria del vostre consentiment. No es poden desactivar.' },
       functional: { title: 'Funcionals', desc: 'Recorden les vostres preferències, com l’idioma o el xat, perquè no les hàgiu de tornar a configurar.' },
@@ -873,6 +906,7 @@
     colPurpose: 'Qëllimi',
     colExpiry: 'Skadon',
     floating: 'Cilësimet e cookie-ve',
+    extraTitle: 'Informacione shtesë',
     cat: {
       necessary: { title: 'Të nevojshme', desc: 'Nevojiten që faqja të funksionojë — hyrja, siguria, ruajtja e pëlqimit tuaj. Nuk mund të fiken.' },
       functional: { title: 'Funksionale', desc: 'Mbajnë mend preferencat tuaja, si gjuha ose biseda, që të mos i vendosni sërish.' },
@@ -901,6 +935,7 @@
     colPurpose: 'Цел',
     colExpiry: 'Истекува',
     floating: 'Поставки за колачиња',
+    extraTitle: 'Дополнителни информации',
     cat: {
       necessary: { title: 'Неопходни', desc: 'Потребни се за страницата да работи — најава, безбедност, помнење на вашата согласност. Не можат да се исклучат.' },
       functional: { title: 'Функционални', desc: 'Ги паметат вашите поставки, на пример јазикот или разговорот, за да не ги задавате повторно.' },

package/src/ck-ui.js

@@ -33,6 +33,15 @@
       bannerLabel: 'Cookie consent',
       panelTitle: 'Cookie settings',
       panelIntro: 'Choose what to allow. By default only the necessary ones are on.',
+      /* SPEC V1.16 §1.2 — the «Additional information» card at the foot of the
+         panel: who the operator is, where to write, how long an answer takes,
+         where to complain. The HEADING has a real translation in every locale;
+         the BODY is deliberately empty in every dictionary, because the block
+         renders only when the site actually supplies text. A default sentence
+         here would put an empty operator card on every site that never
+         configured one. */
+      extraTitle: 'Additional information',
+      extraText: '',
       save: 'Save choices',
       close: 'Close',
       alwaysOn: 'always on',
@@ -101,6 +110,10 @@
       bannerLabel: 'Согласие на cookie',
       panelTitle: 'Настройки cookie',
       panelIntro: 'Выберите, что разрешить. По умолчанию включено только необходимое.',
+      // SPEC V1.16 §1.2. Заголовок переведён везде, тело пустое везде — см.
+      // комментарий у en выше.
+      extraTitle: 'Дополнительно',
+      extraText: '',
       save: 'Сохранить выбор',
       close: 'Закрыть',
       alwaysOn: 'всегда активны',
@@ -169,7 +182,16 @@
     // group's own one. Both are plain strings, so they belong here: a key left
     // out of this list is `undefined` for all 32 external locales and renders
     // the literal word "undefined" on the card.
-    'svcDetails', 'svcListLabel'
+    'svcDetails', 'svcListLabel',
+    /* SPEC V1.16 §1.2 — the «Дополнительно» card. Both belong here for the
+       usual reason (a DICT key missing from this list is `undefined` for all 32
+       external locales), but they behave differently on purpose:
+
+         extraTitle — translated everywhere, so every locale has a heading.
+         extraText  — '' in every dictionary. The merge line below keeps '' when
+                      the locale supplies nothing, and the panel treats '' as
+                      «no block». Only config.texts.<lang>.extraText fills it. */
+    'extraTitle', 'extraText'
   ];
 
   // Plural-form keys, filled separately from STR_KEYS (see above).
@@ -260,13 +282,74 @@
     return list[idx].replace('{n}', String(n));
   }
 
-  // Deep two-level fill from en: a partial locale must never yield undefined,
-  // which would render the literal string "undefined".
-  function buildStrings(lang, table) {
+  /* SPEC V1.16 §1.1 — per-language dictionary overrides from the CONFIG.
+
+     `config.texts` is a mixed bag: it has carried `policyUrl`, `detailsAction`,
+     `declarationUrl` and `cabinetUrl` since 0.5.0, and 0.5.15 adds `links`. So a
+     key is a language dictionary only when it LOOKS like a language tag — that
+     regex is the whole separation, and it is why no future scalar setting under
+     `texts` can ever be mistaken for one (none of them is two letters).
+
+     Own properties only, and the value must be a plain object: `texts` is
+     author-supplied JSON that may have been merged over a prototype, and
+     reading an inherited key would hand the merge below a function. */
+  var LANG_KEY_RE = /^[a-z]{2}(-[a-z]{2})?$/;
+
+  function configTexts(cfg, code) {
+    var texts = (cfg && cfg.texts && typeof cfg.texts === 'object' && !Array.isArray(cfg.texts))
+      ? cfg.texts : null;
+    if (!texts) return null;
+    var k = String(code || '').toLowerCase();
+    if (!LANG_KEY_RE.test(k)) return null;
+    if (!Object.prototype.hasOwnProperty.call(texts, k)) return null;
+    var v = texts[k];
+    return (v && typeof v === 'object' && !Array.isArray(v)) ? v : null;
+  }
+
+  /* The keys an override may reach. A WHITELIST, not «whatever the object
+     carries»: an operator writing their own banner copy has no business
+     rewriting «Принять всё» (the button labels are what a visitor recognises
+     across sites) or the plural tables (an array here would break plural()).
+     `cat.<name>.title/desc` is handled separately below, one level deeper. */
+  var OVERRIDE_KEYS = [
+    'bannerTitle', 'bannerText', 'panelTitle', 'panelIntro', 'extraTitle', 'extraText'
+  ];
+
+  // A non-empty string wins; empty or missing falls through to the layer below.
+  // That is what makes an empty field in the cabinet mean «take the dictionary»
+  // rather than «render nothing».
+  function pickOverride(src, key) {
+    if (!src) return null;
+    if (!Object.prototype.hasOwnProperty.call(src, key)) return null;
+    var v = src[key];
+    return (typeof v === 'string' && v) ? v : null;
+  }
+
+  /* Deep two-level fill from en: a partial locale must never yield undefined,
+     which would render the literal string "undefined".
+
+     Three layers as of 0.5.15: builtin DICT <- window.__ckLocales (both already
+     folded into `table`) <- config.texts[lang]. `cfg` is OPTIONAL on purpose —
+     placeholderText() and the cabinet's own calls ask for the plain dictionary,
+     and an absent third argument must build exactly what 0.5.14 built. */
+  function buildStrings(lang, table, cfg) {
     var src = table[lang] || {};
     var base = DICT.en;
     var out = {};
     var i, c;
+
+    /* Exact code first, then the two-letter base of the RESOLVED language:
+       a banner that resolved to `pt-br` takes `texts['pt-br']` over
+       `texts['pt']`, and a site that only wrote `texts.pt` still reaches it.
+       Same shape as resolveLang(), so the override follows the banner. */
+    var code = String(lang || '').toLowerCase();
+    var ov = configTexts(cfg, code);
+    var ovBase = (code.length > 2) ? configTexts(cfg, code.slice(0, 2)) : null;
+
+    function override(key) {
+      return pickOverride(ov, key) || pickOverride(ovBase, key);
+    }
+
     for (i = 0; i < STR_KEYS.length; i++) {
       var k = STR_KEYS[i];
       out[k] = (typeof src[k] === 'string' && src[k]) ? src[k] : base[k];
@@ -290,9 +373,309 @@
         desc: (typeof e.desc === 'string' && e.desc) ? e.desc : base.cat[c].desc
       };
     }
+
+    /* SPEC V1.16 §1.1 — the config layer, applied LAST so it wins over both the
+       builtin dictionary and __ckLocales. Only the whitelisted keys, and only
+       non-empty strings: an override that is absent, empty or not a string
+       leaves whatever the two lower layers produced.
+
+       Nothing here is ever treated as HTML. These strings go through el()'s
+       textContent and (for extraText) renderRich(), which builds nodes with
+       createElement/createTextNode — an author who writes «<b>» sees the
+       characters «<b>», which is the contract the server's validator mirrors. */
+    if (ov || ovBase) {
+      for (i = 0; i < OVERRIDE_KEYS.length; i++) {
+        var ok = OVERRIDE_KEYS[i];
+        var hit = override(ok);
+        if (hit) out[ok] = hit;
+      }
+      // cat.<name>.title / cat.<name>.desc, one level deeper. Read from a
+      // `cat` object on the override, with the same exact-then-base chain.
+      var ovCat = (ov && ov.cat && typeof ov.cat === 'object') ? ov.cat : null;
+      var ovBaseCat = (ovBase && ovBase.cat && typeof ovBase.cat === 'object') ? ovBase.cat : null;
+      for (i = 0; i < ALL_CATS.length; i++) {
+        c = ALL_CATS[i];
+        var oe = (ovCat && ovCat[c] && typeof ovCat[c] === 'object') ? ovCat[c] : null;
+        var obe = (ovBaseCat && ovBaseCat[c] && typeof ovBaseCat[c] === 'object') ? ovBaseCat[c] : null;
+        var t = pickOverride(oe, 'title') || pickOverride(obe, 'title');
+        var d = pickOverride(oe, 'desc') || pickOverride(obe, 'desc');
+        if (t) out.cat[c].title = t;
+        if (d) out.cat[c].desc = d;
+      }
+    }
+    return out;
+  }
+
+  /* ------------------------------------------ rich text (SPEC V1.16 §1.2) */
+
+  /* The tiny markup subset the «Дополнительно» block accepts. It exists because
+     an operator block is genuinely structured text — two or three paragraphs, a
+     bold e-mail address, a link to the supervisory authority — and because the
+     alternative (accepting HTML) would mean sanitising author HTML in the
+     browser, which is a class of bug we are not going to own.
+
+     THE RULES, in the order they are applied. The server's validator mirrors
+     this exactly, so the order is part of the contract, not an implementation
+     detail:
+
+       1. A blank line (two newlines, any surrounding spaces) splits paragraphs.
+          Each paragraph becomes one <p>.
+       2. Inside a paragraph, a single newline becomes <br>.
+       3. LINKS ARE TOKENISED FIRST, before anything else looks at the text:
+            [label](URL)   with URL http(s):// or mailto:
+            a bare https?:// URL
+            a bare e-mail address
+          Link-first is not a preference — it is what stops the bare-URL rule
+          from eating the address inside «[Центр](https://datepersonale.md)»
+          and stops the bare-e-mail rule from firing inside a mailto: label.
+       4. `**bold**` is applied only to the TEXT RUNS BETWEEN links. So bold does
+          not nest inside a link label and a link does not appear inside bold —
+          one pass, no nesting, nothing recursive to get wrong.
+       5. Any other URL scheme in [label](…) — javascript:, data:, file: — is
+          NOT a link. The WHOLE literal «[label](javascript:…)» is rendered as
+          plain text: visibly wrong to whoever wrote it, rather than silently
+          dropping the address and leaving a label that looks like a link.
+       6. There is no HTML. «<b>» is five characters of text, always.
+
+     Returns an ARRAY of nodes, so the caller decides where they go. Pure apart
+     from document.createElement, which is what makes «no innerHTML» mechanical
+     rather than a promise. */
+
+  // [label](url) — the label may not contain brackets, the url may not contain
+  // whitespace or a closing paren. Deliberately strict: an address that needs
+  // an escaped paren is an address that belongs in a plain bare-URL run.
+  var MD_LINK_RE = /\[([^\]\[]+)\]\(([^()\s]+)\)/;
+  var BARE_URL_RE = /https?:\/\/[^\s<>()\[\]"']+[^\s<>()\[\]"'.,;:!?]/;
+  // Simple on purpose: an address that this misses renders as plain text, which
+  // is a worse link, not a security hole. Anything clever here is a false
+  // positive waiting to turn a sentence into a mailto:.
+  var BARE_MAIL_RE = /[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)+/;
+
+  // http(s) for an outbound link, mailto: for an address. Everything else is
+  // refused — a javascript: or data: URL in a control the visitor is invited to
+  // click is the XSS vector resolveDetails() already refuses for policyUrl.
+  function richHref(url) {
+    var u = str(url);
+    if (!u) return null;
+    if (/^https?:\/\//i.test(u)) return u;
+    if (/^mailto:[^\s]+@[^\s]+$/i.test(u)) return u;
+    return null;
+  }
+
+  function richLink(label, href) {
+    var a = el('a', 'ck-rich__link', label);
+    a.href = href;
+    a.target = '_blank';
+    a.rel = 'noopener';
+    return a;
+  }
+
+  /* `**bold**` over a plain run. Non-greedy and never across a newline, so an
+     unclosed «**» is two literal asterisks rather than a bold tail that
+     swallows the rest of the paragraph. */
+  var BOLD_RE = /\*\*([^*\n]+)\*\*/;
+
+  /* PASS 3 — bare addresses inside one run of plain text. Runs LAST, on text
+     that no longer contains any [label](url), so it cannot reach inside one. */
+  function richBare(text, out) {
+    var rest = String(text);
+    while (rest) {
+      var url = BARE_URL_RE.exec(rest);
+      var mail = BARE_MAIL_RE.exec(rest);
+      // Whichever address starts first. A URL wins a tie: «https://a@b.md» is
+      // an address with a userinfo part, not an e-mail sitting after a scheme.
+      var m = null, isMail = false;
+      if (url) { m = url; }
+      if (mail && (!m || mail.index < m.index)) { m = mail; isMail = true; }
+      if (!m) { out.push(document.createTextNode(rest)); return; }
+      if (m.index > 0) out.push(document.createTextNode(rest.slice(0, m.index)));
+      out.push(richLink(m[0], isMail ? ('mailto:' + m[0]) : m[0]));
+      rest = rest.slice(m.index + m[0].length);
+    }
+  }
+
+  /* PASS 2 — `**bold**` over one run of text, then PASS 3 inside each half.
+
+     Bold has to come BEFORE the bare-address rules, not after: «**mail@x.md**»
+     is one bold run containing an address, and a pass that linked the address
+     first would split the run in three and leave BOLD_RE looking at «**» and
+     «**» separately — the asterisks would survive on screen. That is the whole
+     reason these are three ordered passes rather than one left-to-right walk. */
+  function richBold(text, out) {
+    var rest = String(text);
+    var m;
+    while ((m = BOLD_RE.exec(rest))) {
+      if (m.index > 0) richBare(rest.slice(0, m.index), out);
+      var strong = el('strong', null);
+      var inner = [];
+      richBare(m[1], inner);            // an address inside bold is still a link
+      for (var i = 0; i < inner.length; i++) strong.appendChild(inner[i]);
+      out.push(strong);
+      rest = rest.slice(m.index + m[0].length);
+    }
+    if (rest) richBare(rest, out);
+  }
+
+  /* PASS 1 — one line of a paragraph -> nodes.
+
+     `[label](url)` is tokenised first and its pieces never reach passes 2 and 3:
+     that is what stops the bare-URL rule from eating the address inside the
+     parens, stops the bare-e-mail rule from firing inside a mailto: label, and
+     leaves a label's own «**» literal (rule 4 of the contract). The text
+     BETWEEN markdown links goes through richBold(), which then runs richBare()
+     inside and outside each bold span. */
+  function richLine(line, out) {
+    var rest = String(line);
+    var m;
+    while ((m = MD_LINK_RE.exec(rest))) {
+      if (m.index > 0) richBold(rest.slice(0, m.index), out);
+      var href = richHref(m[2]);
+      // Rule 5: a refused scheme is the whole literal, verbatim and unbolded,
+      // so «[x](javascript:alert(1))» reads as exactly what was written.
+      if (href) out.push(richLink(m[1], href));
+      else out.push(document.createTextNode(m[0]));
+      rest = rest.slice(m.index + m[0].length);
+    }
+    if (rest) richBold(rest, out);
+  }
+
+  /* text -> array of <p> nodes. Empty (or non-string) input gives an empty
+     array, which is what lets the caller say «no text, no block» by asking for
+     the length rather than by re-testing the string. */
+  function renderRich(text) {
+    var s = (typeof text === 'string') ? text : '';
+    if (!s.trim()) return [];
+    // \r\n and \r normalised first: a value pasted from Windows or copied out of
+    // a textarea must split into the same paragraphs as one typed here.
+    var paras = s.replace(/\r\n?/g, '\n').split(/\n[ \t]*\n+/);
+    var out = [];
+    for (var i = 0; i < paras.length; i++) {
+      var para = paras[i].replace(/^\n+|\n+$/g, '');
+      if (!para.trim()) continue;
+      var p = el('p', 'ck-rich__p');
+      var lines = para.split('\n');
+      for (var j = 0; j < lines.length; j++) {
+        if (j > 0) p.appendChild(el('br'));       // rule 2: a single newline
+        var nodes = [];
+        richLine(lines[j], nodes);
+        for (var k = 0; k < nodes.length; k++) p.appendChild(nodes[k]);
+      }
+      out.push(p);
+    }
+    return out;
+  }
+
+  /* ------------------------------------------ banner links (SPEC V1.16 §1.3) */
+
+  /* `texts.links` — up to three of the operator's own addresses, rendered under
+     the banner buttons and at the foot of the settings panel. The obvious pair
+     is «Политика конфиденциальности» and «Политика cookie», which a Moldovan
+     site is required to publish and which have nowhere else to go on the card.
+
+     Deliberately NOT tangled with `detailsAction`: «Подробнее» keeps doing
+     exactly what it did in 0.5.14, because a site that gains a link row must
+     not silently lose the link it already had.
+
+     A row is skipped, never faked, when its address is not http(s) or when no
+     label resolves for the banner's language — a link with no words on it is
+     not a link. The cap is applied to the SURVIVORS: one malformed row must not
+     cost a good one its place. */
+  function linkLabel(labels, lang) {
+    if (!labels || typeof labels !== 'object' || Array.isArray(labels)) return null;
+    var code = (typeof lang === 'string') ? lang.toLowerCase() : '';
+    // Own properties only, exactly as branding's pickPoweredByText does it and
+    // for the same reason: `labels` is author-supplied JSON, and an inherited
+    // key would hand str() a function instead of a missing line.
+    function own(k) {
+      return (k && Object.prototype.hasOwnProperty.call(labels, k)) ? str(labels[k]) : null;
+    }
+    var hit = own(code);
+    if (!hit && code.length > 2) hit = own(code.slice(0, 2));       // ru-RU -> ru
+    return hit || own('en');
+  }
+
+  var MAX_LINKS = 3;
+
+  function resolveLinks(cfg, lang) {
+    var texts = (cfg && cfg.texts && typeof cfg.texts === 'object') ? cfg.texts : null;
+    var list = texts && texts.links;
+    if (!list || !Array.isArray(list)) return [];
+    var out = [];
+    for (var i = 0; i < list.length && out.length < MAX_LINKS; i++) {
+      var row = list[i];
+      if (!row || typeof row !== 'object') continue;
+      var url = str(row.url);
+      if (!url || !/^https?:\/\//i.test(url)) continue;
+      var label = linkLabel(row.label, lang);
+      if (!label) continue;
+      out.push({ id: str(row.id) || ('link' + i), url: url, label: label });
+    }
     return out;
   }
 
+  /* SPEC V1.16 §1.3, last sentence — the one place where the link row DOES
+     touch «Подробнее»: when the address it would send the visitor to is
+     already one of the rows under the buttons, the banner shows the same
+     address twice. The second copy is not more information, it is noise, so
+     the in-text link is dropped and the banner renders as `detailsAction:
+     'hide'` for that render — the link row keeps the address, with a label the
+     operator wrote, which is the better of the two.
+
+     Only 'policy' and 'declaration' can duplicate anything: 'settings' opens
+     the panel and has no address to collide with, and 'hide' is already gone.
+
+     Comparison is deliberately narrow. Trimming and a trailing slash are
+     typography, not identity — `https://shop.md/cookies` and
+     `…/cookies/` are the same page — and so is the case of the HOST, which
+     DNS does not distinguish. The PATH is left alone: `/Cookies` and
+     `/cookies` are genuinely two addresses on a case-sensitive server, and
+     suppressing a real «Подробнее» link over that guess is the worse error. */
+  function normHref(v) {
+    var s = str(v);
+    if (!s) return null;
+    var m = /^(https?:\/\/[^\/?#]*)([\s\S]*)$/i.exec(s);
+    if (!m) return null;
+    return (m[1].toLowerCase() + m[2]).replace(/\/$/, '');
+  }
+
+  function detailsDuplicatesLink(details, links) {
+    if (!details) return false;
+    if (details.kind !== 'policy' && details.kind !== 'declaration') return false;
+    var href = normHref(details.href);
+    if (!href || !links || !Array.isArray(links)) return false;
+    for (var i = 0; i < links.length; i++) {
+      if (links[i] && normHref(links[i].url) === href) return true;
+    }
+    return false;
+  }
+
+  /* Which of the three shapes the banner will actually draw, duplicate rule
+     applied — so buildBanner() and signature() cannot disagree about it.
+     `lang` is the code the banner resolved to; signature() passes the config's
+     own so both sides of a comparison are read in the same language. */
+  function detailsKind(cfg, lang) {
+    var det = resolveDetails(cfg);
+    var code = (typeof lang === 'string' && lang) ? lang :
+      resolveLang(cfg && cfg.language, localeTable());
+    return detailsDuplicatesLink(det, resolveLinks(cfg, code)) ? 'hide' : det.kind;
+  }
+
+  // The row itself, or null when there is nothing to draw — so both call sites
+  // (banner and panel) are one `if` rather than two.
+  function buildLinksRow(cfg, cls) {
+    var links = resolveLinks(cfg, LANG);
+    if (!links.length) return null;
+    var row = el('div', 'ck-links' + (cls ? ' ' + cls : ''));
+    for (var i = 0; i < links.length; i++) {
+      var a = el('a', 'ck-links__a', links[i].label);
+      a.href = links[i].url;
+      a.target = '_blank';
+      a.rel = 'noopener';
+      row.appendChild(a);
+    }
+    return row;
+  }
+
   /* ------------------------------------------- blocked-embed placeholder (§2) */
 
   /* The one piece of the placeholder that is worth testing without a DOM: which
@@ -537,6 +920,40 @@
        >= 4.5:1 rule as «Подробнее» — see the note on the `a{}` rule above. */
     '.ck-svc__policy{display:inline-block;margin-top:4px;font-size:12.5px;color:var(--ck-link)}',
 
+    /* ---- «Дополнительно» card (SPEC V1.16 §1.2) ---- */
+    /* A card, not another category row: it carries no switch and answers a
+       different question — who the operator is and how to reach them. So it
+       gets the soft fill and the rounded border the cookie table wears, which
+       reads as «a panel of reference text» rather than «a fifth thing you can
+       turn off».
+
+       It is appended AFTER the categories, which means the last .ck-cat is no
+       longer `:last-child` and keeps its bottom rule — that is wanted here: the
+       rule is what separates the last category from this block. The rule below
+       restores the old look for the category above it only in the sense that
+       the separator now belongs to the boundary rather than to the group. */
+    '.ck-extra{margin:16px 0 4px;padding:14px 16px;background:var(--ck-soft);',
+    'border:1px solid var(--ck-line);border-radius:var(--ck-radius-card)}',
+    '.ck-extra__title{margin:0 0 6px;font-size:15px;font-weight:600}',
+    /* Same size and colour as .ck-cat__desc: this is secondary reference text,
+       and it is measured for AA against the card by the same rule. */
+    '.ck-extra__body p{margin:0 0 8px;font-size:13.5px;color:var(--ck-muted);line-height:1.5}',
+    '.ck-extra__body p:last-child{margin-bottom:0}',
+    /* --ck-link, not --ck-accent — accent-coloured TEXT answers to 4.5:1
+       against the card; see the note on the `a{}` rule above. */
+    '.ck-extra__body a{color:var(--ck-link)}',
+
+    /* ---- link row under the buttons (SPEC V1.16 §1.3) ---- */
+    /* One row, wrapping. `width:100%` matters in the bar layout, whose banner is
+       a flex row: without it the row would try to sit BESIDE the buttons on a
+       wide screen instead of under them. */
+    '.ck-links{display:flex;gap:14px;flex-wrap:wrap;width:100%;margin-top:12px;font-size:13px}',
+    '.ck-links__a{color:var(--ck-link)}',
+    /* The panel foot is a flex row of buttons that each take `flex:1 1 150px`;
+       a full-width row forced onto its own line keeps the links under the
+       buttons rather than wedged between two of them. */
+    '.ck-links--panel{flex-basis:100%;margin-top:2px}',
+
     /* ---- switch ---- */
     '.ck-switch{flex:none;width:46px;height:27px;padding:0;border-radius:999px;',
     'border:1px solid var(--ck-line);background:var(--ck-soft);position:relative}',
@@ -585,6 +1002,9 @@
     '.ck-banner--bar .ck-banner__body{display:contents}',
     '.ck-banner--bar .ck-banner__body>*{order:1}',
     '.ck-banner--bar .ck-actions{order:2}',
+    // SPEC V1.16 §1.3 — the link row is `order:3` so it stays under the buttons
+    // in the bar's mobile column, where every child's position is explicit.
+    '.ck-banner--bar .ck-links{order:3}',
     /* Reference: the box's button row becomes a column under 560px. */
     '.ck-banner--box .ck-actions{flex-direction:column}',
     '.ck-banner--box .ck-btn{flex:1 1 auto;width:100%}}',
@@ -2088,6 +2508,14 @@
 
     var p = el('p');
     var det = resolveDetails(cfg);
+    /* SPEC V1.16 §1.3 — «Подробнее» and one of the link rows point at the same
+       page: drop the in-text copy rather than print the address twice. Asked
+       through detailsKind() so the shape drawn here is the same one signature()
+       watches for changes. The links are resolved for THIS render's language,
+       exactly as buildLinksRow does below, so a row that no visitor of this
+       banner can see (no label in their language) never silences the link
+       they can. */
+    if (detailsKind(cfg, LANG) === 'hide') det = { kind: 'hide', href: null };
     if (det.kind === 'hide') {
       p.appendChild(document.createTextNode(T.bannerText));
     } else {
@@ -2148,6 +2576,18 @@
     actions.appendChild(custom);
     b.appendChild(actions);
 
+    /* SPEC V1.16 §1.3 — the link row, under the buttons in all three layouts.
+       Appended to the BANNER rather than to the body, so it sits after the
+       actions in DOM (and reading) order everywhere: box and modal stack, and
+       the bar's `width:100%` on .ck-links forces it onto its own line under
+       the row instead of squeezing in beside the buttons.
+
+       The bar's mobile media query re-orders its children explicitly (body
+       contents `order:1`, actions `order:2`); the row carries `order:3` there
+       so it stays below the buttons rather than jumping above them. */
+    var blinks = buildLinksRow(cfg, 'ck-links--banner');
+    if (blinks) b.appendChild(blinks);
+
     // box/modal: the foot follows the buttons (see the note above).
     if (foot && lay.type !== 'bar') b.appendChild(foot);
 
@@ -2159,6 +2599,21 @@
     root.appendChild(b);
   }
 
+  /* SPEC V1.16 §1.2 — the «Дополнительно» card, or null when the site supplied
+     no text for this language. T.extraText has already been through the whole
+     merge (dictionary '' <- __ckLocales <- config.texts[lang] <- [base]), so
+     the only question left here is whether anything survived it. */
+  function buildExtra() {
+    var nodes = renderRich(T.extraText);
+    if (!nodes.length) return null;
+    var box = el('div', 'ck-extra');
+    box.appendChild(el('h3', 'ck-extra__title', T.extraTitle));
+    var bodyEl = el('div', 'ck-extra__body');
+    for (var i = 0; i < nodes.length; i++) bodyEl.appendChild(nodes[i]);
+    box.appendChild(bodyEl);
+    return box;
+  }
+
   function buildPanel(cfg) {
     var scrim = el('div', 'ck-panel-scrim ck-hidden');
     scrim.setAttribute('aria-hidden', 'true');
@@ -2186,6 +2641,18 @@
     var body = el('div', 'ck-panel__body');
     var cats = ['necessary'].concat(activeOptIn(cfg));
     for (var i = 0; i < cats.length; i++) body.appendChild(buildCategory(cfg, cats[i]));
+
+    /* SPEC V1.16 §1.2 — «Дополнительно», after the categories and their service
+       lists, before the buttons. INSIDE .ck-panel__body, which is the scrolling
+       region: an operator block runs to a paragraph or three, and put between
+       the body and the foot it would be clipped on a short viewport with no way
+       to reach the end of it.
+
+       Rendered only when the resolved extraText is a non-empty string — every
+       dictionary ships '', so a site that never configured one draws nothing
+       and the panel is byte-for-byte what 0.5.14 drew. */
+    var extra = buildExtra();
+    if (extra) body.appendChild(extra);
     p.appendChild(body);
 
     var foot = el('div', 'ck-panel__foot');
@@ -2213,6 +2680,11 @@
     foot.appendChild(save);
     foot.appendChild(acc);
     foot.appendChild(rej);
+    // SPEC V1.16 §1.3 — the operator's own addresses, under the panel's buttons
+    // and above the attribution, so the bottom of the panel reads: what you can
+    // do, then where to read more, then who made this.
+    var plinks = buildLinksRow(cfg, 'ck-links--panel');
+    if (plinks) foot.appendChild(plinks);
     // Same attribution foot as the banner: mark and credit sign the bottom,
     // below the action buttons, never the panel heading.
     var pfoot = buildPoweredBy(cfg);
@@ -2769,7 +3241,14 @@
       // Structural: link / button / nothing are three different DOM shapes,
       // and mount() is one-shot. Buttons and colours are deliberately NOT
       // here — they are token values and restyle in place.
-      resolveDetails(c).kind,
+      /* SPEC V1.16 §1.3 — the EFFECTIVE kind, not the configured one: a config
+         whose policyUrl grows into (or out of) one of its own link rows flips
+         the shape between link and nothing while resolveDetails still answers
+         'policy'. Without the fold, a SaaS config arriving after the first
+         mount would leave the duplicate on screen. The language is the config's
+         own, resolved the way mount() resolves it, so the two sides of a
+         comparison are always read in the same language. */
+      detailsKind(c),
       /* SPEC V1.12 §3 — services are STRUCTURAL: each one adds a row with its
          own switch to the panel, and mount() is one-shot. Without this a SaaS
          config that arrives after the first mount (the second, idempotent
@@ -2782,10 +3261,43 @@
          `purpose` is text inside an existing row and does not justify tearing
          the panel down. */
       serviceSignature(c),
+      /* SPEC V1.16 §1 — custom texts are STRUCTURAL for the same reason
+         services are: the «Дополнительно» card and the link row are DOM nodes
+         that appear and disappear, and mount() is one-shot. A SaaS config that
+         arrives after the first render (the second, idempotent init()) would
+         otherwise leave a panel with no operator block on a site that has one.
+
+         Not the texts themselves, which can be long: the LANGUAGE KEYS that
+         carry overrides, whether an extra block would render, and the links'
+         identity. A reworded sentence inside a block that is already on screen
+         does not justify tearing the panel down mid-decision. */
+      textsSignature(c),
       brandSignature(c)
     ].join('|');
   }
 
+  function textsSignature(cfg) {
+    var texts = (cfg && cfg.texts && typeof cfg.texts === 'object' && !Array.isArray(cfg.texts))
+      ? cfg.texts : null;
+    if (!texts) return '0';
+    var langs = [];
+    for (var k in texts) {
+      if (!Object.prototype.hasOwnProperty.call(texts, k)) continue;
+      if (LANG_KEY_RE.test(String(k).toLowerCase())) langs.push(String(k).toLowerCase());
+    }
+    langs.sort();
+    var list = texts.links;
+    var ids = [];
+    if (Array.isArray(list)) {
+      for (var i = 0; i < list.length; i++) {
+        var row = list[i];
+        if (row && typeof row === 'object') ids.push(String(row.id || i) + ':' + String(row.url || ''));
+      }
+    }
+    if (!langs.length && !ids.length) return '0';
+    return langs.join(',') + '/' + ids.join(',');
+  }
+
   function serviceSignature(cfg) {
     var list = cfg && cfg.services;
     if (!list || !Array.isArray(list) || !list.length) return '0';
@@ -2828,7 +3340,10 @@
 
     var table = localeTable();                       // read at render time
     LANG = resolveLang(cfg && cfg.language, table);
-    T = buildStrings(LANG, table);
+    // SPEC V1.16 §1.1 — the config is the third merge layer, so it must be
+    // handed in here: this is the only place that knows which language the
+    // banner actually resolved to, which is what the override is keyed by.
+    T = buildStrings(LANG, table, cfg);
 
     host = document.getElementById('ck-root');
     if (!host) {
@@ -2964,6 +3479,22 @@
       servicePurpose: servicePurpose,
       groupCountLabel: groupCountLabel,
       serviceSignature: serviceSignature,
+      /* SPEC V1.16 §1 — the pure halves of the custom-text feature, so the
+         cabinet's live preview quotes the same rules the banner paints and the
+         server's validator can be tested against the same contract.
+
+         renderRich() is the exception to «nothing here touches the DOM»: it
+         BUILDS nodes, so it needs document.createElement. That is deliberate —
+         the whole point of the function is that there is no innerHTML anywhere
+         in it, and a version that returned a string could not promise that. It
+         is still pure in every other sense: same input, same nodes, no reads of
+         module state. In a context with no `document` it is simply not called. */
+      renderRich: renderRich,
+      resolveLinks: resolveLinks,
+      linkLabel: linkLabel,
+      detailsDuplicatesLink: detailsDuplicatesLink,
+      detailsKind: detailsKind,
+      textsSignature: textsSignature,
       signature: signature
     };
     // The page-font probe reads the DOM, so it is not part of the pure block —