@ecomconsult/consentkit 0.5.2 → 0.5.4

package/npm/internal-stub.mjs

@@ -28,7 +28,7 @@ export function undecidedState() {
  */
 export function createStub() {
   const stub = {
-    version: '0.5.2',
+    version: '0.5.4',
     config: {},
     init: function () { return undecidedState(); },
     allowed: function (cat) { return cat === 'necessary'; },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ecomconsult/consentkit",
-  "version": "0.5.2",
+  "version": "0.5.4",
   "description": "GDPR cookie consent core with blocking engine, Shadow DOM UI and Google Consent Mode v2. Zero dependencies, no build step.",
   "repository": {
     "type": "git",

package/src/ck-core.js

@@ -81,6 +81,13 @@
     // INFRA_DB: the rest of Cloudflare's edge is infrastructure, but this one
     // beacon is a measurement product (§8 names it by hand for that reason).
     'static.cloudflareinsights.com': 'analytics',
+    // Tilda's stats endpoint. The REST of tildaapi.one is platform plumbing and
+    // sits in INFRA_DB host by host; this one subdomain measures visitors, so it
+    // is classified here instead. There is deliberately NO bare `tildaapi.one`
+    // in either table: lookupHostMap returns the FIRST matching key, not the
+    // longest, so a bare entry could shadow this one depending on insertion
+    // order. Every Tilda API host is therefore named in full.
+    'stat.tildaapi.one': 'analytics',
 
     // --- marketing -----------------------------------------------------
     'connect.facebook.net': 'marketing',
@@ -137,6 +144,22 @@
     // iuteCredit — a Moldovan consumer-credit calculator embedded on shop
     // product pages. A third party the owner chose, offering a feature.
     'iutecredit.md': 'functional',
+    // Google Maps — a map or a store locator the owner embedded. It is a
+    // FEATURE, not measurement: a visitor who declines functional loses the map
+    // and nothing else. The two API hosts are dedicated to Maps, so the whole
+    // host is the right scope; the www.google.com/maps halves cannot be, and
+    // are path-scoped in PATH_DB below.
+    //
+    // maps.gstatic.com is the deliberate exception to `gstatic.com` sitting in
+    // INFRA_DB: the parent serves fonts and ordinary images a page is broken
+    // without, but this subdomain serves the map tiles and marker sprites of an
+    // embed the owner chose. categoryForUrl runs BEFORE the strict allowlist, so
+    // naming it here classifies (and holds) it while fonts.gstatic.com stays
+    // waved through — which is the split the pair of tests in blocking.test.mjs
+    // pins down.
+    'maps.googleapis.com': 'functional',
+    'places.googleapis.com': 'functional',
+    'maps.gstatic.com': 'functional',
 
     // --- necessary -----------------------------------------------------
     // recaptcha.net is Google's alternate reCAPTCHA domain, served for regions
@@ -183,6 +206,34 @@
     '/gtag/js': 'analytics',            // googletagmanager.com/gtag/js?id=G-XXXX
     'www.google.com/recaptcha/': 'necessary',
     'www.gstatic.com/recaptcha/': 'necessary',
+    // Google Maps on www.google.<tld>. Like reCAPTCHA above, the host cannot be
+    // given a category as a whole, so the map is named by path. Functional: it
+    // is a map the owner put on the page, and allowed() holds it until the
+    // visitor accepts functional.
+    //
+    // The host half is kept IN the key rather than matching a bare '/maps/'.
+    // Every fragment here is tested against the WHOLE resolved URL, so a bare
+    // key would also classify a site's OWN page at /maps/… . For '/gtag/js'
+    // that is intended (a self-hosted gtag really is analytics); a first-party
+    // route called /maps/embed is just a route.
+    //
+    // Google serves the iframe embed from google.com/maps/embed regardless of
+    // the visitor's country, so google.com covers the embed case; the ccTLD
+    // hosts appear for /maps/ links, which the first key covers on www.google
+    // .com and which are ordinary navigation elsewhere.
+    'www.google.com/maps/': 'functional',
+    'google.com/maps/embed': 'functional',   // also maps.google.com
+    // Google Ads pings that carry no cookie of their own but still report a
+    // visit to the ad platform — the remarketing/conversion beacons a gtag or
+    // Ads tag fires against www.google.<tld>. They reach doubleclick.net too,
+    // where HOST_DB already files them as marketing; these keys are what catches
+    // the www.google.com and www.google.lt (and every other ccTLD) form, which
+    // no host entry can cover without ruling on all of Google at once. Matching
+    // is a substring test against the WHOLE resolved URL, so a leading path
+    // fragment matches every host.
+    '/pagead/1p-user-list/': 'marketing',
+    '/pagead/1p-conversion/': 'marketing',
+    '/ads/ga-audiences': 'marketing',
     '/trackers/ga.js': 'analytics',
     '/trackers/pixel.js': 'marketing',
     '/trackers/chat.js': 'functional'
@@ -304,7 +355,21 @@
     // --- site builders and hosting platforms ---------------------------
     'tildacdn.com',
     'tildacdn.net',
+    'tildacdn.one',
+    'static.tildacdn.one',                 // redundant under the line above, named
+                                           // for symmetry with the tildacdn.com
+                                           // fixtures, which use the same subdomain
     'tilda.ws',
+    // Tilda's own platform APIs: block feeds, geo lookup, the members area and
+    // form delivery. A Tilda page is broken without them and none of them is a
+    // decision the site owner made — they are the builder serving its own site.
+    // Enumerated one by one rather than as a bare `tildaapi.one`, because
+    // stat.tildaapi.one IS measurement and sits in HOST_DB as analytics; a bare
+    // suffix here would be a claim about that host too.
+    'feeds.tildaapi.one',
+    'geo.tildaapi.one',
+    'members.tildaapi.one',
+    'forms.tildaapi.one',
     'static.wixstatic.com',
     'parastorage.com',                     // Wix static assets
     'cdn.shopify.com',
@@ -325,6 +390,8 @@
     'b-cdn.net',                           // bunny.net
     // --- fonts ----------------------------------------------------------
     'fonts.googleapis.com',
+    'fonts.google.com',                    // the catalogue host; some embeds and
+                                           // builders link stylesheets through it
     // gstatic.com whole: Google's static-asset domain. Its subdomains serve
     // fonts (fonts.gstatic.com), the reCAPTCHA widget's own code
     // (www.gstatic.com/recaptcha/) and ordinary images — assets a page is
@@ -880,6 +947,15 @@
   // miss every page that sets it after the core loads.
   function isInfraHost(host) {
     if (!host) { return false; }
+    // A host the database gives a CATEGORY to is never infrastructure, even when
+    // it sits under an INFRA_DB suffix. Without this, maps.gstatic.com (named as
+    // `functional` in HOST_DB, under a bare `gstatic.com` here) would be held
+    // back by the engine until functional consent while the scanner — which
+    // reads _infra() to set thirdParty[].infra — filed it as infrastructure and
+    // kept it out of the report entirely. Blocking and reporting would then
+    // disagree about one host, which is exactly what §8 exists to prevent.
+    // Every other INFRA_DB entry is uncategorised, so this changes nothing else.
+    if (lookupHostMap(EXTRA_DB, host) || lookupHostMap(HOST_DB, host)) { return false; }
     for (var i = 0; i < INFRA_DB.length; i++) {
       if (hostMatches(host, INFRA_DB[i])) { return true; }
     }
@@ -1461,7 +1537,7 @@
   // Public API
   // ---------------------------------------------------------------------------
   var ConsentKit = {
-    version: '0.5.2',
+    version: '0.5.4',
     config: config,
 
     init: function (userConfig) {

package/src/ck-debug.js

@@ -207,6 +207,7 @@
       themeFontInherit: 'наследуется',
       themeFontSystem: 'системный',
       themeFontPage: 'со страницы',
+      themeFontTry: 'попытка',
       themeRadius: 'скругления',
       themeCard: 'карточка',
       themeBtn: 'кнопки',
@@ -267,6 +268,7 @@
       themeFontInherit: 'inherited',
       themeFontSystem: 'system',
       themeFontPage: 'from the page',
+      themeFontTry: 'attempt',
       themeRadius: 'radii',
       themeCard: 'card',
       themeBtn: 'buttons',
@@ -607,12 +609,19 @@
      site whose body is unstyled is exactly the Times bug being diagnosed. */
   function fontRow(built, T) {
     if (built.font !== 'inherit') return built.font + ' (' + T.themeFontSystem + ')';
-    var page = null;
+    var page = null, n = 0;
     try {
       if (CK && typeof CK._resolvePageFont === 'function') page = CK._resolvePageFont();
     } catch (e) { page = null; }
-    return page ? page + ' (' + T.themeFontPage + ')'
-                : 'inherit (' + T.themeFontInherit + ')';
+    // The attempt number is the whole point of the 0.5.3 re-probe: a page whose
+    // stylesheets land late resolves on look 2 or 3, and «попытка 1» vs
+    // «попытка 3» is what tells those two pages apart in the panel.
+    try {
+      if (CK && typeof CK._pageFontAttempt === 'function') n = CK._pageFontAttempt();
+    } catch (e) { n = 0; }
+    var tries = (typeof n === 'number' && n > 1) ? ', ' + T.themeFontTry + ' ' + n : '';
+    return page ? page + ' (' + T.themeFontPage + tries + ')'
+                : 'inherit (' + T.themeFontInherit + tries + ')';
   }
 
   // Resolved lazily, not at parse time: this file runs before ConsentKit.init()

package/src/ck-ui.js

@@ -702,6 +702,40 @@
     return null;
   }
 
+  /* One probe at mount is not enough. On a page whose stylesheets are injected
+     by script (Tilda is the reported case) a CACHED reload mounts the banner
+     BEFORE those sheets apply, so every sample still computes to the UA default
+     and the probe returns null — the banner stays in Times and nothing looks
+     again. So the mount probe is only the first look: re-probes are scheduled
+     until the answer stops changing.
+
+     Both halves of that schedule are pure arithmetic, published on _contrast so
+     the behaviour is testable without timers or a DOM.
+
+     The timed ladder, in ms after mount. Deliberately front-loaded: a page that
+     styles itself quickly is corrected before a visitor can read the banner,
+     and the 4 s tail catches a slow webfont-driven sheet. `window.load` and
+     `document.fonts.ready` fire on their own and are NOT part of this ladder. */
+  var REPROBE_DELAYS = [500, 1500, 4000];
+
+  // Attempt is 1-based over the TIMED probes only; null means "no more timers".
+  function nextProbeDelay(attempt) {
+    if (typeof attempt !== 'number' || !isFinite(attempt) || attempt < 1) return null;
+    var i = Math.floor(attempt) - 1;
+    return i < REPROBE_DELAYS.length ? REPROBE_DELAYS[i] : null;
+  }
+
+  /* Should a freshly probed family replace what the banner is painting?
+     `current` is the applied value (null while the page still states nothing).
+     Only a non-null find is ever worth applying — a later null means the page
+     got LESS specific, which never happens for real and would otherwise throw
+     away a good answer. */
+  function shouldReprobe(current, found) {
+    if (typeof found !== 'string' || !found) return false;
+    if (typeof current !== 'string' || !current) return true;   // null -> found
+    return normFamily(current) !== normFamily(found);
+  }
+
   // Ordered so the first hit is the most representative body text on the page.
   var FONT_PROBES = ['main p', 'article p', '[role=main] p', 'p', 'h1', 'h2', 'a', 'button', 'li'];
 
@@ -735,6 +769,12 @@
   // after a remount) quotes the value the banner actually painted.
   var pageFont = null;
 
+  /* How many times the SCHEDULER has looked, for the debug panel's «попытка N».
+     Counted here and not inside resolvePageFont() on purpose: _resolvePageFont()
+     re-runs the whole probe on every debug-panel render, and counting there would
+     report «попытка 14» after a few renders and exhaust the cap on nothing. */
+  var fontProbeCount = 1;          // the mount probe is attempt 1
+
   function resolvePageFont() {
     if (typeof document === 'undefined') return pageFont;
     try {
@@ -766,6 +806,97 @@
     return pageFont;
   }
 
+  /* ------------------------------------------------ page-font re-probing */
+
+  /* Live timers, so remount() can cancel a schedule that belongs to the DOM it
+     is about to throw away. Everything here is guarded and only ever RUNS after
+     mount(), so the parse-time SSR context below never reaches it. */
+  var fontTimers = [];
+  var fontStable = false;          // a non-null value survived one extra probe
+  var fontScheduled = false;
+
+  // Cap on SCHEDULED probes (the mount probe is not one of them): the three
+  // timed rungs plus window.load plus fonts.ready.
+  var MAX_REPROBES = 5;
+
+  function clearFontTimers() {
+    for (var i = 0; i < fontTimers.length; i++) {
+      try { clearTimeout(fontTimers[i]); } catch (e) { /* noop */ }
+    }
+    fontTimers = [];
+  }
+
+  /* One look. Re-applies the theme when the family changed, and reports whether
+     the answer has now held still for a whole extra probe — which is the only
+     thing that stops the ladder early. Applying and stopping are deliberately
+     separate: a first non-null find is painted IMMEDIATELY (the visitor must not
+     wait out the confirmation), the confirmation only decides about timers. */
+  function probeFontOnce() {
+    var before = pageFont;
+    var found = resolvePageFont();               // rewrites the pageFont cache
+    if (shouldReprobe(before, found)) {
+      // applyTheme() rewrites themeStyle.textContent wholesale, so the --ck-font
+      // rule is REPLACED rather than appended a second time.
+      try { applyTheme(safeConfig()); } catch (e) { /* noop */ }
+      fontStable = false;
+      return false;
+    }
+    // Unchanged. Stable only once we have an actual family in hand: a page that
+    // keeps answering null is exactly the case that has to keep looking.
+    if (found) { fontStable = true; return true; }
+    return false;
+  }
+
+  /* Run a scheduled probe. Every trigger — window.load, fonts.ready and each
+     rung of the timed ladder — funnels through here so the cap and the counter
+     are counted in one place. */
+  function runScheduledProbe() {
+    if (!mounted || fontStable) return;
+    if (fontProbeCount >= 1 + MAX_REPROBES) return;
+    fontProbeCount++;
+    if (probeFontOnce()) clearFontTimers();      // settled: drop the rest
+  }
+
+  /* Called once from the end of mount(). Not from applyTheme(): that runs again
+     on every palette-only ck:init, which would restart the whole ladder. */
+  function scheduleFontProbes(cfg) {
+    if (typeof window === 'undefined' || typeof document === 'undefined') return;
+    if (fontScheduled) return;
+    // theme.font:'system' is a fixed stack — there is nothing to sample.
+    try {
+      var t = (cfg && cfg.theme) || {};
+      if (resolveFont(t) !== 'inherit') return;
+    } catch (e) { return; }
+
+    fontScheduled = true;
+    try {
+      for (var a = 1; ; a++) {
+        var d = nextProbeDelay(a);
+        if (d === null) break;
+        fontTimers.push(setTimeout(runScheduledProbe, d));
+      }
+    } catch (e) { /* noop */ }
+
+    // A cached reload's mount can precede the page's own stylesheets; `load`
+    // is the first moment every <link> in the document has definitely applied.
+    try {
+      if (document.readyState === 'complete') {
+        // Already past it — the ladder covers this case on its own.
+      } else {
+        window.addEventListener('load', function () { runScheduledProbe(); }, { once: true });
+      }
+    } catch (e) { /* noop */ }
+
+    // A webfont swapping in can change the computed family outright.
+    try {
+      if (document.fonts && typeof document.fonts.ready === 'object' &&
+          document.fonts.ready && typeof document.fonts.ready.then === 'function') {
+        document.fonts.ready.then(function () { runScheduledProbe(); },
+                                  function () { /* noop */ });
+      }
+    } catch (e) { /* noop */ }
+  }
+
   /* --------------------------------------------------- button resolution */
 
   var BTN_ROLES = ['accept', 'reject', 'settings'];
@@ -1030,7 +1161,11 @@
     var fontCss = '';
     if (built.font === 'inherit') {
       var page = resolvePageFont();
-      if (page) fontCss = '\n:host{--ck-font:' + page + '}';
+      // Owner rule (2026-09-06): the page's font when it can be read, the
+      // system stack when it cannot — never a bare `inherit`, which on Tilda
+      // and friends resolves to <body>'s browser default (Times). A later
+      // re-probe that finds the page font swaps the system stack out again.
+      fontCss = '\n:host{--ck-font:' + (page || SYSTEM_FONT) + '}';
     } else {
       pageFont = null;                          // theme.font:'system' opts out
     }
@@ -1407,6 +1542,21 @@
 
   function openPanel(invoker) {
     if (!mounted || !nodes.panel) return;
+    /* A visitor who opens the settings long after load is the last chance to
+       get the typeface right, and by then the page is certainly styled. Only
+       when the banner is still on `inherit` — a resolved family is left alone
+       so opening the panel can never restyle a correct banner. Hooked here
+       rather than on the ck:ui:open-preferences listener because the banner's
+       own «Настроить» button calls openPanel() directly.
+
+       Gated on fontScheduled, which is only ever set for a theme that actually
+       samples the page: with theme.font:'system' applyTheme() nulls pageFont on
+       every call, so without this the condition would be permanently true and
+       every panel open would re-probe the DOM and rewrite the sheet to produce
+       byte-identical CSS, forever. */
+    if (fontScheduled && !pageFont && !fontStable) {
+      try { probeFontOnce(); } catch (e) { /* noop */ }
+    }
     lastFocus = invoker || root.activeElement || document.activeElement;
     syncSwitches(safeState());
     nodes.panelScrim.classList.remove('ck-hidden');
@@ -1482,6 +1632,12 @@
     mounted = false;
     panelOpen = false;
     lastFocus = null;
+    // The pending schedule belongs to the shadow root about to be rebuilt; the
+    // fresh mount() starts its own ladder from a clean count.
+    clearFontTimers();
+    fontScheduled = false;
+    fontStable = false;
+    fontProbeCount = 1;
     mount(cfg);
   }
 
@@ -1526,6 +1682,10 @@
     mounted = true;
     mountedSig = signature(cfg);
     syncFromState();
+
+    // Only now: scheduleFontProbes() re-applies the theme from a timer, and
+    // applyTheme() is a no-op until there is a host and a themeStyle to write.
+    scheduleFontProbes(cfg);
   }
 
   /* ---------------------------------------------------------------- events */
@@ -1553,6 +1713,8 @@
       resolveRadius: resolveRadius,
       resolveFont: resolveFont,
       pickPageFont: pickPageFont,
+      nextProbeDelay: nextProbeDelay,
+      shouldReprobe: shouldReprobe,
       resolveDetails: resolveDetails,
       buildThemeCss: buildThemeCss
     };
@@ -1563,6 +1725,10 @@
     ck._resolvePageFont = function () {
       return (typeof document === 'undefined' || !root) ? pageFont : resolvePageFont();
     };
+    // How many times the SCHEDULER has looked (1 = the mount probe alone). The
+    // debug panel prints it: on a Tilda-style page the interesting fact is that
+    // the family arrived on the third look, not on the first.
+    ck._pageFontAttempt = function () { return fontProbeCount; };
   })();
 
   // SSR-safe: with no DOM there is nothing to render or listen to, so importing