@ecomconsult/consentkit 0.5.3 → 0.5.5

package/npm/internal-stub.mjs

@@ -28,7 +28,7 @@ export function undecidedState() {
  */
 export function createStub() {
   const stub = {
-    version: '0.5.3',
+    version: '0.5.5',
     config: {},
     init: function () { return undecidedState(); },
     allowed: function (cat) { return cat === 'necessary'; },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ecomconsult/consentkit",
-  "version": "0.5.3",
+  "version": "0.5.5",
   "description": "GDPR cookie consent core with blocking engine, Shadow DOM UI and Google Consent Mode v2. Zero dependencies, no build step.",
   "repository": {
     "type": "git",

package/src/ck-core.js

@@ -81,6 +81,13 @@
     // INFRA_DB: the rest of Cloudflare's edge is infrastructure, but this one
     // beacon is a measurement product (§8 names it by hand for that reason).
     'static.cloudflareinsights.com': 'analytics',
+    // Tilda's stats endpoint. The REST of tildaapi.one is platform plumbing and
+    // sits in INFRA_DB host by host; this one subdomain measures visitors, so it
+    // is classified here instead. There is deliberately NO bare `tildaapi.one`
+    // in either table: lookupHostMap returns the FIRST matching key, not the
+    // longest, so a bare entry could shadow this one depending on insertion
+    // order. Every Tilda API host is therefore named in full.
+    'stat.tildaapi.one': 'analytics',
 
     // --- marketing -----------------------------------------------------
     'connect.facebook.net': 'marketing',
@@ -137,6 +144,22 @@
     // iuteCredit — a Moldovan consumer-credit calculator embedded on shop
     // product pages. A third party the owner chose, offering a feature.
     'iutecredit.md': 'functional',
+    // Google Maps — a map or a store locator the owner embedded. It is a
+    // FEATURE, not measurement: a visitor who declines functional loses the map
+    // and nothing else. The two API hosts are dedicated to Maps, so the whole
+    // host is the right scope; the www.google.com/maps halves cannot be, and
+    // are path-scoped in PATH_DB below.
+    //
+    // maps.gstatic.com is the deliberate exception to `gstatic.com` sitting in
+    // INFRA_DB: the parent serves fonts and ordinary images a page is broken
+    // without, but this subdomain serves the map tiles and marker sprites of an
+    // embed the owner chose. categoryForUrl runs BEFORE the strict allowlist, so
+    // naming it here classifies (and holds) it while fonts.gstatic.com stays
+    // waved through — which is the split the pair of tests in blocking.test.mjs
+    // pins down.
+    'maps.googleapis.com': 'functional',
+    'places.googleapis.com': 'functional',
+    'maps.gstatic.com': 'functional',
 
     // --- necessary -----------------------------------------------------
     // recaptcha.net is Google's alternate reCAPTCHA domain, served for regions
@@ -183,6 +206,34 @@
     '/gtag/js': 'analytics',            // googletagmanager.com/gtag/js?id=G-XXXX
     'www.google.com/recaptcha/': 'necessary',
     'www.gstatic.com/recaptcha/': 'necessary',
+    // Google Maps on www.google.<tld>. Like reCAPTCHA above, the host cannot be
+    // given a category as a whole, so the map is named by path. Functional: it
+    // is a map the owner put on the page, and allowed() holds it until the
+    // visitor accepts functional.
+    //
+    // The host half is kept IN the key rather than matching a bare '/maps/'.
+    // Every fragment here is tested against the WHOLE resolved URL, so a bare
+    // key would also classify a site's OWN page at /maps/… . For '/gtag/js'
+    // that is intended (a self-hosted gtag really is analytics); a first-party
+    // route called /maps/embed is just a route.
+    //
+    // Google serves the iframe embed from google.com/maps/embed regardless of
+    // the visitor's country, so google.com covers the embed case; the ccTLD
+    // hosts appear for /maps/ links, which the first key covers on www.google
+    // .com and which are ordinary navigation elsewhere.
+    'www.google.com/maps/': 'functional',
+    'google.com/maps/embed': 'functional',   // also maps.google.com
+    // Google Ads pings that carry no cookie of their own but still report a
+    // visit to the ad platform — the remarketing/conversion beacons a gtag or
+    // Ads tag fires against www.google.<tld>. They reach doubleclick.net too,
+    // where HOST_DB already files them as marketing; these keys are what catches
+    // the www.google.com and www.google.lt (and every other ccTLD) form, which
+    // no host entry can cover without ruling on all of Google at once. Matching
+    // is a substring test against the WHOLE resolved URL, so a leading path
+    // fragment matches every host.
+    '/pagead/1p-user-list/': 'marketing',
+    '/pagead/1p-conversion/': 'marketing',
+    '/ads/ga-audiences': 'marketing',
     '/trackers/ga.js': 'analytics',
     '/trackers/pixel.js': 'marketing',
     '/trackers/chat.js': 'functional'
@@ -304,7 +355,21 @@
     // --- site builders and hosting platforms ---------------------------
     'tildacdn.com',
     'tildacdn.net',
+    'tildacdn.one',
+    'static.tildacdn.one',                 // redundant under the line above, named
+                                           // for symmetry with the tildacdn.com
+                                           // fixtures, which use the same subdomain
     'tilda.ws',
+    // Tilda's own platform APIs: block feeds, geo lookup, the members area and
+    // form delivery. A Tilda page is broken without them and none of them is a
+    // decision the site owner made — they are the builder serving its own site.
+    // Enumerated one by one rather than as a bare `tildaapi.one`, because
+    // stat.tildaapi.one IS measurement and sits in HOST_DB as analytics; a bare
+    // suffix here would be a claim about that host too.
+    'feeds.tildaapi.one',
+    'geo.tildaapi.one',
+    'members.tildaapi.one',
+    'forms.tildaapi.one',
     'static.wixstatic.com',
     'parastorage.com',                     // Wix static assets
     'cdn.shopify.com',
@@ -325,6 +390,8 @@
     'b-cdn.net',                           // bunny.net
     // --- fonts ----------------------------------------------------------
     'fonts.googleapis.com',
+    'fonts.google.com',                    // the catalogue host; some embeds and
+                                           // builders link stylesheets through it
     // gstatic.com whole: Google's static-asset domain. Its subdomains serve
     // fonts (fonts.gstatic.com), the reCAPTCHA widget's own code
     // (www.gstatic.com/recaptcha/) and ordinary images — assets a page is
@@ -880,6 +947,15 @@
   // miss every page that sets it after the core loads.
   function isInfraHost(host) {
     if (!host) { return false; }
+    // A host the database gives a CATEGORY to is never infrastructure, even when
+    // it sits under an INFRA_DB suffix. Without this, maps.gstatic.com (named as
+    // `functional` in HOST_DB, under a bare `gstatic.com` here) would be held
+    // back by the engine until functional consent while the scanner — which
+    // reads _infra() to set thirdParty[].infra — filed it as infrastructure and
+    // kept it out of the report entirely. Blocking and reporting would then
+    // disagree about one host, which is exactly what §8 exists to prevent.
+    // Every other INFRA_DB entry is uncategorised, so this changes nothing else.
+    if (lookupHostMap(EXTRA_DB, host) || lookupHostMap(HOST_DB, host)) { return false; }
     for (var i = 0; i < INFRA_DB.length; i++) {
       if (hostMatches(host, INFRA_DB[i])) { return true; }
     }
@@ -1461,7 +1537,7 @@
   // Public API
   // ---------------------------------------------------------------------------
   var ConsentKit = {
-    version: '0.5.3',
+    version: '0.5.5',
     config: config,
 
     init: function (userConfig) {

package/src/ck-locales.js

@@ -553,30 +553,30 @@
   };
 
   L.ro = {
-    bannerTitle: 'Folosim cookie-uri',
-    bannerText: 'Cookie-urile necesare mențin site-ul în funcțiune. Restul — analiză, marketing, funcții suplimentare — pornește doar dacă permiteți. Vă puteți răzgândi oricând.',
+    bannerTitle: 'Cookie-uri pe acest site',
+    bannerText: 'Cookie-urile necesare mențin site-ul în funcțiune. Restul pornesc doar cu acordul dumneavoastră. Puteți schimba decizia oricând.',
     more: 'Aflați mai multe',
     acceptAll: 'Acceptă tot',
     rejectAll: 'Respinge tot',
     customize: 'Personalizează',
     bannerLabel: 'Consimțământ pentru cookie-uri',
     panelTitle: 'Setări cookie-uri',
-    panelIntro: 'Alegeți ce cookie-uri permiteți. Nimic opțional nu este pornit până nu îl porniți dumneavoastră.',
+    panelIntro: 'Alegeți ce permiteți. Implicit este pornit doar strictul necesar.',
     save: 'Salvează alegerea',
     close: 'Închide',
     alwaysOn: 'mereu active',
-    cookiesIn: 'Cookie-uri din acest grup',
+    cookiesIn: 'Ce cookie-uri',
     noCookies: 'Nu au fost declarate cookie-uri pentru acest grup.',
-    colName: 'Nume',
-    colVendor: 'Furnizor',
-    colPurpose: 'Scop',
+    colName: 'Denumire',
+    colVendor: 'Cine le pune',
+    colPurpose: 'Pentru ce',
     colExpiry: 'Expiră',
     floating: 'Setări cookie-uri',
     cat: {
-      necessary: { title: 'Necesare', desc: 'Sunt necesare pentru funcționarea site-ului: autentificare, securitate, reținerea consimțământului. Nu pot fi dezactivate.' },
-      functional: { title: 'Funcționale', desc: 'Rețin preferințele dumneavoastră, precum limba sau chatul, ca să nu le setați din nou.' },
-      analytics: { title: 'Analiză', desc: 'Ne arată ce pagini sunt folosite, ca să reparăm ce derutează. Doar cifre, fără nume.' },
-      marketing: { title: 'Marketing', desc: 'Ne permit să vă arătăm reclame pe alte site-uri și să măsurăm dacă au fost de folos.' }
+      necessary: { title: 'Necesare', desc: 'Sunt necesare pentru funcționarea site-ului: autentificare, securitate, reținerea alegerii dumneavoastră. Nu pot fi dezactivate.' },
+      functional: { title: 'Funcționale', desc: 'Rețin alegerile dumneavoastră: limba, coșul, chatul.' },
+      analytics: { title: 'Analiză', desc: 'Ne ajută să înțelegem ce merge bine pe site și ce nu.' },
+      marketing: { title: 'Marketing', desc: 'Potrivesc reclamele cu interesele dumneavoastră pe alte site-uri.' }
     }
   };
 

package/src/ck-ui.js

@@ -12,82 +12,82 @@
 
   var DICT = {
     en: {
-      bannerTitle: 'We use cookies',
-      bannerText: 'Necessary cookies keep the site working. Everything else — analytics, marketing, extra features — runs only if you allow it. You can change your mind at any time.',
+      bannerTitle: 'Cookies on this site',
+      bannerText: 'Necessary cookies keep the site working. The rest are used only if you allow them. You can change your choice at any time.',
       more: 'Learn more',
       acceptAll: 'Accept all',
       rejectAll: 'Reject all',
       customize: 'Customize',
       bannerLabel: 'Cookie consent',
       panelTitle: 'Cookie settings',
-      panelIntro: 'Choose which cookies you allow. Nothing optional is on until you turn it on.',
+      panelIntro: 'Choose what to allow. By default only the necessary ones are on.',
       save: 'Save choices',
       close: 'Close',
       alwaysOn: 'always on',
-      cookiesIn: 'Cookies in this group',
+      cookiesIn: 'Which cookies',
       noCookies: 'No cookies declared for this group.',
       colName: 'Name',
-      colVendor: 'Provider',
-      colPurpose: 'Purpose',
+      colVendor: 'Who sets it',
+      colPurpose: 'What for',
       colExpiry: 'Expires',
       floating: 'Cookie settings',
       poweredBy: 'Powered by ConsentKit',
       cat: {
         necessary: {
           title: 'Necessary',
-          desc: 'Needed for the site to work — signing in, security, remembering your consent. They cannot be turned off.'
+          desc: 'Needed for the site to work: signing in, security, remembering your choice. They cannot be turned off.'
         },
         functional: {
           title: 'Functional',
-          desc: 'Remember your preferences, such as language or chat, so you do not set them up again.'
+          desc: 'Remember your choices: language, basket, chat.'
         },
         analytics: {
           title: 'Analytics',
-          desc: 'Help us see which pages people use, so we can fix what is confusing. Numbers only, no names.'
+          desc: 'Help us understand what works well on the site and what does not.'
         },
         marketing: {
           title: 'Marketing',
-          desc: 'Let us show you ads on other sites and measure whether they were any use.'
+          desc: 'Match ads to your interests on other sites.'
         }
       }
     },
     ru: {
-      bannerTitle: 'Мы используем cookie',
-      bannerText: 'Необходимые cookie нужны, чтобы сайт работал. Всё остальное — аналитика, маркетинг, дополнительные удобства — включается только с вашего согласия. Решение можно изменить в любой момент.',
+      bannerTitle: 'Cookie на этом сайте',
+      bannerText: 'Необходимые cookie нужны, чтобы сайт работал. Остальные включаются только с вашего согласия. Решение можно изменить в любой момент.',
       more: 'Подробнее',
       acceptAll: 'Принять всё',
       rejectAll: 'Отклонить всё',
       customize: 'Настроить',
       bannerLabel: 'Согласие на cookie',
       panelTitle: 'Настройки cookie',
-      panelIntro: 'Выберите, какие cookie вы разрешаете. Ничего необязательного не включено, пока вы сами это не сделаете.',
+      panelIntro: 'Выберите, что разрешить. По умолчанию включено только необходимое.',
       save: 'Сохранить выбор',
       close: 'Закрыть',
       alwaysOn: 'всегда активны',
-      cookiesIn: 'Cookie в этой группе',
+      cookiesIn: 'Какие cookie',
       noCookies: 'Для этой группы cookie не заявлены.',
-      colName: 'Имя',
-      colVendor: 'Поставщик',
-      colPurpose: 'Цель',
+      colName: 'Название',
+      colVendor: 'Кто ставит',
+      colPurpose: 'Зачем',
       colExpiry: 'Срок',
       floating: 'Настройки cookie',
       poweredBy: 'Работает на ConsentKit',
       cat: {
         necessary: {
           title: 'Необходимые',
-          desc: 'Без них сайт не работает: вход, безопасность, память о вашем выборе. Отключить нельзя.'
+          desc: 'Нужны, чтобы сайт работал: вход, безопасность, память о вашем выборе. Отключить нельзя.'
         },
         functional: {
           title: 'Функциональные',
-          desc: 'Запоминают ваши настройки — например язык или чат, — чтобы вы не задавали их заново.'
+          desc: 'Запоминают ваш выбор: язык, корзину, чат.'
         },
         analytics: {
           title: 'Аналитика',
-          desc: 'Показывают нам, какими страницами вы пользуетесь, чтобы мы исправили неудобное. Только цифры, без имён.'
+          desc: 'Помогают нам понять, что на сайте удобно, а что нет.'
         },
         marketing: {
           title: 'Маркетинг',
-          desc: 'Позволяют показывать вам рекламу на других сайтах и понимать, была ли от неё польза.'
+          desc: 'Подбирают рекламу под ваши интересы на других сайтах.'
         }
       }
     }