@emplugins/emprivacy 1.0.0 → 2.0.0

package/dist/index.mjs

@@ -1,22 +1,889 @@
-import { a as assertValidCloudflareToken, c as isValidPolicyHrefInput, i as PLUGIN_ID, l as normalizeConfig, n as DEFAULT_CONFIG, r as KV_KEY, s as isRootRelativeSitePath, t as COOKIE_NAME, u as resolvePolicyHref } from "./config-BJ1LHuri.mjs";
+import { definePlugin } from "emdash";
+import { z } from "zod";
 
+//#region src/config.ts
+/**
+* EmPrivacy KV document (`consent:config`) and shared helpers.
+*/
+const KV_KEY = "consent:config";
+const COOKIE_NAME = "emprivacy_cc";
+const PLUGIN_ID = "emprivacy";
+const DEFAULT_CONFIG = {
+	bannerTitle: "Cookies & privacy",
+	bannerMessage: "We use cookies to run this site and optionally for analytics and marketing. You can accept or customize your choices.",
+	privacyPolicyUrl: "/privacy",
+	cookiePolicyUrl: "",
+	strictDefaults: true,
+	policyVersion: "1",
+	cloudflareWebAnalyticsToken: "",
+	analyticsProvider: "cloudflare",
+	analyticsScriptUrls: [],
+	marketingScriptUrls: [],
+	googleConsentMode: false,
+	logConsentToServer: false
+};
+function hasUnsafeUrlChars(s) {
+	return /[\u0000-\u001F\u007F\s]/.test(s);
+}
+function isHttpsUrl(s) {
+	try {
+		const t = s.trim();
+		if (!t) return false;
+		if (hasUnsafeUrlChars(t)) return false;
+		if (/%0d|%0a|%09|%0b|%0c|%20/i.test(t)) return false;
+		const u = new URL(t);
+		if (u.protocol !== "https:") return false;
+		if (u.username || u.password) return false;
+		return true;
+	} catch {
+		return false;
+	}
+}
+function invalidScriptUrlError(kind, u) {
+	if (u.includes("<") || u.includes(">")) return `Invalid ${kind} script URL (https only). Paste one full https:// URL per line (the script src only), not a <script> tag or HTML comment. Example: https://static.cloudflareinsights.com/beacon.min.js. The invalid line was: ${u}`;
+	return `Invalid ${kind} script URL (https only): ${u}`;
+}
+function isAnalyticsProvider(s) {
+	return s === "cloudflare" || s === "none" || s === "custom";
+}
+/** Reject characters that would break JSON or attributes; allow typical Cloudflare site token strings. */
+function assertValidCloudflareToken(t) {
+	const s = t.trim();
+	if (s.length === 0) return;
+	if (s.length > 256) throw new Error("Cloudflare site token is too long.");
+	if (/[\s<>'"&]/.test(s)) throw new Error("Cloudflare site token contains invalid characters.");
+}
+/**
+* Root-relative public path (EmDash page route), e.g. `/privacy`.
+* Rejects protocol-relative URLs (`//…`) and whitespace.
+*/
+function isRootRelativeSitePath(s) {
+	const t = s.trim();
+	if (t.length === 0) return false;
+	if (!t.startsWith("/")) return false;
+	if (t.startsWith("//")) return false;
+	if (hasUnsafeUrlChars(t)) return false;
+	return true;
+}
+/** For hooks: turn stored path or absolute URL into a public absolute URL. */
+function resolvePolicyHref(stored, ctx) {
+	const t = stored.trim();
+	if (!t) return t;
+	if (isRootRelativeSitePath(t)) return ctx.url(t);
+	return t;
+}
+function isValidPolicyHrefInput(s) {
+	const t = s.trim();
+	if (!t) return false;
+	return isHttpsUrl(t) || isRootRelativeSitePath(t);
+}
+function parseUrlList(text) {
+	const lines = text.split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
+	return [...new Set(lines)];
+}
+function assertLength(label, s, min, max) {
+	const t = s.trim();
+	if (t.length < min) throw new Error(`${label} is required.`);
+	if (t.length > max) throw new Error(`${label} is too long.`);
+}
+function assertOptionalLength(label, s, max) {
+	if (s.trim().length > max) throw new Error(`${label} is too long.`);
+}
+function normalizeConfig(raw) {
+	if (typeof raw !== "object" || raw === null) return { ...DEFAULT_CONFIG };
+	const o = raw;
+	const analytics = Array.isArray(o.analyticsScriptUrls) ? o.analyticsScriptUrls.filter((x) => typeof x === "string") : DEFAULT_CONFIG.analyticsScriptUrls;
+	const marketing = Array.isArray(o.marketingScriptUrls) ? o.marketingScriptUrls.filter((x) => typeof x === "string") : DEFAULT_CONFIG.marketingScriptUrls;
+	const cfTok = typeof o.cloudflareWebAnalyticsToken === "string" ? o.cloudflareWebAnalyticsToken : "";
+	const apCandidate = typeof o.analyticsProvider === "string" ? o.analyticsProvider.trim() : "";
+	let analyticsProvider;
+	if (isAnalyticsProvider(apCandidate)) analyticsProvider = apCandidate;
+	else if (analytics.length > 0) analyticsProvider = "custom";
+	else analyticsProvider = DEFAULT_CONFIG.analyticsProvider;
+	return {
+		bannerTitle: typeof o.bannerTitle === "string" ? o.bannerTitle : DEFAULT_CONFIG.bannerTitle,
+		bannerMessage: typeof o.bannerMessage === "string" ? o.bannerMessage : DEFAULT_CONFIG.bannerMessage,
+		privacyPolicyUrl: typeof o.privacyPolicyUrl === "string" ? o.privacyPolicyUrl : DEFAULT_CONFIG.privacyPolicyUrl,
+		cookiePolicyUrl: typeof o.cookiePolicyUrl === "string" ? o.cookiePolicyUrl : DEFAULT_CONFIG.cookiePolicyUrl,
+		strictDefaults: typeof o.strictDefaults === "boolean" ? o.strictDefaults : DEFAULT_CONFIG.strictDefaults,
+		policyVersion: typeof o.policyVersion === "string" && o.policyVersion.length > 0 ? o.policyVersion : DEFAULT_CONFIG.policyVersion,
+		cloudflareWebAnalyticsToken: cfTok,
+		analyticsProvider,
+		analyticsScriptUrls: analytics,
+		marketingScriptUrls: marketing,
+		googleConsentMode: typeof o.googleConsentMode === "boolean" ? o.googleConsentMode : DEFAULT_CONFIG.googleConsentMode,
+		logConsentToServer: typeof o.logConsentToServer === "boolean" ? o.logConsentToServer : DEFAULT_CONFIG.logConsentToServer
+	};
+}
+/** Validate admin-submitted fields; throws an Error with a short message on failure */
+function assertValidSavedConfig(input) {
+	assertLength("Policy version", input.policyVersion, 1, 64);
+	assertOptionalLength("Banner title", input.bannerTitle, 120);
+	assertOptionalLength("Short notice", input.bannerMessage, 600);
+	const privacyPolicyUrl = input.privacyPolicyUrl.trim();
+	if (!isValidPolicyHrefInput(privacyPolicyUrl)) throw new Error("Privacy policy must be a full https:// URL or a site path to your EmDash Page (e.g. /privacy).");
+	if (privacyPolicyUrl.length > 2048) throw new Error("Privacy policy URL/path is too long.");
+	let cookiePolicyUrl = input.cookiePolicyUrl.trim();
+	if (cookiePolicyUrl && !isValidPolicyHrefInput(cookiePolicyUrl)) throw new Error("Cookie policy must be a valid https:// URL or a root-relative path (e.g. /cookies), or empty.");
+	if (cookiePolicyUrl.length > 2048) throw new Error("Cookie policy URL/path is too long.");
+	if (!cookiePolicyUrl) cookiePolicyUrl = DEFAULT_CONFIG.cookiePolicyUrl;
+	const ap = input.analyticsPlatform.trim() || "cloudflare";
+	if (!isAnalyticsProvider(ap)) throw new Error("Analytics: choose a supported option (Cloudflare, None, or Custom).");
+	const tokenTrim = input.cloudflareToken.trim();
+	if (ap === "cloudflare") assertValidCloudflareToken(tokenTrim);
+	const analyticsScriptUrls = [];
+	if (ap === "custom") {
+		const list = parseUrlList(input.analyticsUrlsText);
+		if (list.length > 50) throw new Error("Analytics script URL list is too long (max 50).");
+		for (const u of list) {
+			if (u.length > 2048) throw new Error(invalidScriptUrlError("analytics", u));
+			if (!isHttpsUrl(u)) throw new Error(invalidScriptUrlError("analytics", u));
+			analyticsScriptUrls.push(u);
+		}
+	}
+	const marketingScriptUrls = [];
+	const mlist = parseUrlList(input.marketingUrlsText);
+	if (mlist.length > 50) throw new Error("Marketing script URL list is too long (max 50).");
+	for (const u of mlist) {
+		if (u.length > 2048) throw new Error(invalidScriptUrlError("marketing", u));
+		if (!isHttpsUrl(u)) throw new Error(invalidScriptUrlError("marketing", u));
+		marketingScriptUrls.push(u);
+	}
+	return normalizeConfig({
+		bannerTitle: input.bannerTitle.trim() || DEFAULT_CONFIG.bannerTitle,
+		bannerMessage: input.bannerMessage.trim() || DEFAULT_CONFIG.bannerMessage,
+		privacyPolicyUrl,
+		cookiePolicyUrl,
+		strictDefaults: input.strictDefaults,
+		policyVersion: input.policyVersion.trim(),
+		analyticsProvider: ap,
+		cloudflareWebAnalyticsToken: ap === "cloudflare" ? tokenTrim : "",
+		analyticsScriptUrls: ap === "custom" ? analyticsScriptUrls : [],
+		marketingScriptUrls,
+		googleConsentMode: input.googleConsentMode,
+		logConsentToServer: input.logConsentToServer
+	});
+}
+
+//#endregion
 //#region src/version.ts
-const VERSION = "1.0.0";
+const VERSION = "2.0.0";
+
+//#endregion
+//#region src/runtime.ts
+const ADMIN_SETTINGS_PATH = "/settings";
+const SAVE_ACTION_ID = "emprivacy-save";
+const recordInput = z.object({
+	policyVersion: z.string().trim().min(1).max(64),
+	analytics: z.boolean(),
+	marketing: z.boolean()
+});
+async function loadConfig(ctx) {
+	const raw = await ctx.kv.get(KV_KEY);
+	if (!raw) return normalizeConfig({});
+	try {
+		return normalizeConfig(JSON.parse(raw));
+	} catch {
+		return normalizeConfig({});
+	}
+}
+async function saveConfigString(ctx, json) {
+	await ctx.kv.set(KV_KEY, json);
+}
+/** Path-only record URL for browser fetch (same origin). */
+function recordPathForSite() {
+	return `/_emdash/api/plugins/${PLUGIN_ID}/record`;
+}
+/** Absolute URL for metadata / banner; paths resolved via EmDash `ctx.url()`. */
+function absolutePolicyHref(stored, ctx) {
+	const r = resolvePolicyHref(stored, ctx).trim();
+	if (!r) return null;
+	try {
+		if (new URL(r).protocol !== "https:") return null;
+		return r;
+	} catch {
+		return null;
+	}
+}
+function buildGoogleConsentHeadScript() {
+	return `(function(){window.dataLayer=window.dataLayer||[];function g(){window.dataLayer.push(arguments);}window.gtag=g;g("consent","default",{"analytics_storage":"denied","ad_storage":"denied","ad_user_data":"denied","ad_personalization":"denied","functionality_storage":"granted","security_storage":"granted","personalization_storage":"denied"});})();`;
+}
+/**
+* Public-site bootstrap: no HTML from admin strings in DOM APIs beyond JSON.parse —
+* banner copy is applied with textContent / createTextNode.
+*/
+function buildBodyBootstrap(pr) {
+	return `(function(){
+var C=${JSON.stringify(pr).replace(/[<>&\u2028\u2029]/g, (c) => {
+		switch (c) {
+			case "<": return "\\u003c";
+			case ">": return "\\u003e";
+			case "&": return "\\u0026";
+			case "\u2028": return "\\u2028";
+			case "\u2029": return "\\u2029";
+			default: return c;
+		}
+	})};
+var CN="${COOKIE_NAME}";
+function readCookie(){
+try{
+var m=document.cookie.match(new RegExp("(?:^|;\\\\s*)"+CN+"=([^;]*)"));
+var v=m?decodeURIComponent(m[1]):"";
+if(!v||v.length>1024)return"";
+return v;
+}catch(e){return"";}
+}
+function writeCookie(val){
+var secure=document.location.protocol==="https:"?"; Secure":"";
+document.cookie=CN+"="+encodeURIComponent(val)+"; Path=/; SameSite=Lax"+secure+"; Max-Age=31536000";
+}
+function parseState(s){
+try{
+var o=JSON.parse(s);
+if(!o||typeof o!=="object")return null;
+if(typeof o.v!=="string")return null;
+if(o.v!==C.policyVersion)return null;
+var a=o.a,m=o.m;
+var aOk=(a===0||a===1||a===true||a===false);
+var mOk=(m===0||m===1||m===true||m===false);
+if(!aOk||!mOk)return null;
+return {v:o.v,a:!!a,m:!!m};
+}catch(e){return null;}
+}
+function needBanner(){
+var c=parseState(readCookie());
+if(!c)return true;
+return false;
+}
+function alreadyScriptSrc(u){
+try{
+return Array.prototype.some.call(document.getElementsByTagName("script"),function(s){
+return s.src===u;
+});
+}catch(e){
+return false;
+}
+}
+function loadScript(src){
+if(alreadyScriptSrc(src))return;
+var e=document.createElement("script");
+e.src=src;e.async=true;e.referrerPolicy="no-referrer-when-downgrade";
+document.head.appendChild(e);
+}
+function loadCloudflareBeacon(token){
+var u="https://static.cloudflareinsights.com/beacon.min.js";
+if(!token)return;
+if(alreadyScriptSrc(u))return;
+var e=document.createElement("script");
+e.src=u;
+e.defer=true;
+e.setAttribute("data-cf-beacon",JSON.stringify({token:token}));
+e.referrerPolicy="no-referrer-when-downgrade";
+document.head.appendChild(e);
+}
+function applyScripts(a,m){
+if(a){
+if(C.analyticsProvider==="cloudflare"){
+loadCloudflareBeacon(C.cloudflareToken);
+}else if(C.analyticsProvider==="custom"){
+C.analyticsScriptUrls.forEach(loadScript);
+}
+}
+if(m)C.marketingScriptUrls.forEach(loadScript);
+}
+function gtagUpdate(a,m){
+if(!C.googleConsentMode||!window.gtag)return;
+window.gtag("consent","update",{
+analytics_storage:a?"granted":"denied",
+ad_storage:m?"granted":"denied",
+ad_user_data:m?"granted":"denied",
+ad_personalization:m?"granted":"denied",
+personalization_storage:m?"granted":"denied"
+});
+}
+function logServer(a,m){
+if(!C.logConsent)return;
+var p=C.recordPath;
+fetch(p,{
+method:"POST",
+credentials:"same-origin",
+headers:{"Content-Type":"application/json"},
+body:JSON.stringify({policyVersion:C.policyVersion,analytics:!!a,marketing:!!m})
+}).catch(function(){});
+}
+function hide(el){if(el)el.setAttribute("hidden","");el&&(el.style.display="none");}
+function show(el){if(el)el.removeAttribute("hidden");el&&(el.style.display="");}
+function mount(){
+var root=document.getElementById("emprivacy-root");
+if(!root)return;
+var trigger=document.createElement("button");
+trigger.type="button";
+trigger.className="emprivacy-cookie-trigger";
+trigger.setAttribute("aria-label","Cookie and privacy settings");
+var ic=document.createElement("span");
+ic.setAttribute("aria-hidden","true");
+ic.className="emprivacy-cookie-trigger-icon";
+ic.appendChild(document.createTextNode("🍪"));
+trigger.appendChild(ic);
+function showTrigger(){
+trigger.removeAttribute("hidden");
+}
+function hideTrigger(){
+trigger.setAttribute("hidden","");
+}
+function mkRow(label,id,on){
+var w=document.createElement("label");
+w.className="emprivacy-switch";
+var cb=document.createElement("input");
+cb.type="checkbox";
+cb.id=id;
+cb.checked=on;
+w.appendChild(cb);
+w.appendChild(document.createTextNode(" "+label));
+return {wrap:w,box:cb};
+}
+function addPolicyLinks(links){
+function addOne(href,text){
+if(!href)return;
+var ok=href.indexOf("https://")===0;
+if(!ok)return;
+var a=document.createElement("a");
+a.href=href;
+a.rel="nofollow noopener";
+a.target="_blank";
+a.appendChild(document.createTextNode(text));
+links.appendChild(a);
+}
+addOne(C.privacyPolicyUrl,"Privacy policy");
+if(C.cookiePolicyUrl)addOne(C.cookiePolicyUrl,"Cookie policy");
+}
+function openReopenPanel(){
+if(root.querySelector(".emprivacy-bar--reopen"))return;
+var st=parseState(readCookie());
+if(!st)return;
+hideTrigger();
+var aOn=!!st.a;
+var mOn=!!st.m;
+var bar=document.createElement("div");
+bar.className="emprivacy-bar emprivacy-bar--reopen";
+bar.setAttribute("role","dialog");
+bar.setAttribute("aria-modal","true");
+var title=document.createElement("h2");
+title.className="emprivacy-title";
+title.appendChild(document.createTextNode(C.bannerTitle));
+var msg=document.createElement("p");
+msg.className="emprivacy-msg";
+msg.appendChild(document.createTextNode(C.bannerMessage));
+var links=document.createElement("div");
+links.className="emprivacy-links";
+addPolicyLinks(links);
+var opts=document.createElement("div");
+opts.className="emprivacy-opts";
+var er=mkRow("Analytics","emprivacy-ra",aOn);
+var mr=mkRow("Marketing","emprivacy-rm",mOn);
+opts.appendChild(er.wrap);
+opts.appendChild(mr.wrap);
+var actions=document.createElement("div");
+actions.className="emprivacy-actions";
+function doReopenPersist(a,m){
+writeCookie(JSON.stringify({v:C.policyVersion,a:a?1:0,m:m?1:0}));
+logServer(a,m);
+location.reload();
+}
+var btnAll=document.createElement("button");
+btnAll.type="button";
+btnAll.className="emprivacy-btn emprivacy-btn-primary";
+btnAll.appendChild(document.createTextNode("Accept all"));
+btnAll.addEventListener("click",function(){doReopenPersist(true,true);});
+var btnRej=document.createElement("button");
+btnRej.type="button";
+btnRej.className="emprivacy-btn";
+btnRej.appendChild(document.createTextNode("Reject non-essential"));
+btnRej.addEventListener("click",function(){doReopenPersist(false,false);});
+var btnSave=document.createElement("button");
+btnSave.type="button";
+btnSave.className="emprivacy-btn emprivacy-btn-primary";
+btnSave.appendChild(document.createTextNode("Save choices"));
+btnSave.addEventListener("click",function(){doReopenPersist(!!er.box.checked,!!mr.box.checked);});
+var btnClose=document.createElement("button");
+btnClose.type="button";
+btnClose.className="emprivacy-btn";
+btnClose.appendChild(document.createTextNode("Close"));
+btnClose.addEventListener("click",function(){
+if(bar.parentNode)bar.parentNode.removeChild(bar);
+showTrigger();
+});
+actions.appendChild(btnAll);
+actions.appendChild(btnRej);
+actions.appendChild(btnSave);
+actions.appendChild(btnClose);
+bar.appendChild(title);
+bar.appendChild(msg);
+bar.appendChild(links);
+bar.appendChild(opts);
+bar.appendChild(actions);
+root.appendChild(bar);
+}
+root.appendChild(trigger);
+hideTrigger();
+if(!needBanner()){
+var st=parseState(readCookie());
+applyScripts(!!(st&&st.a),!!(st&&st.m));
+gtagUpdate(!!(st&&st.a),!!(st&&st.m));
+showTrigger();
+trigger.addEventListener("click",function(){openReopenPanel();});
+return;
+}
+var aOn=C.strictDefaults?false:true;
+var mOn=C.strictDefaults?false:true;
+var bar=document.createElement("div");
+bar.className="emprivacy-bar";
+bar.setAttribute("role","dialog");
+bar.setAttribute("aria-modal","false");
+var title=document.createElement("h2");
+title.className="emprivacy-title";
+title.appendChild(document.createTextNode(C.bannerTitle));
+var msg=document.createElement("p");
+msg.className="emprivacy-msg";
+msg.appendChild(document.createTextNode(C.bannerMessage));
+var links=document.createElement("div");
+links.className="emprivacy-links";
+addPolicyLinks(links);
+var opts=document.createElement("div");
+opts.className="emprivacy-opts";
+opts.setAttribute("hidden","");
+var er=mkRow("Analytics","emprivacy-a",aOn);
+var mr=mkRow("Marketing","emprivacy-m",mOn);
+opts.appendChild(er.wrap);
+opts.appendChild(mr.wrap);
+var actions=document.createElement("div");
+actions.className="emprivacy-actions";
+function persist(a,m){
+writeCookie(JSON.stringify({v:C.policyVersion,a:a?1:0,m:m?1:0}));
+logServer(a,m);
+// For Cloudflare Web Analytics (and most tag-based analytics), injecting after load can miss the initial pageview.
+// Reload ensures the script runs in the normal page lifecycle immediately after consent is persisted.
+location.reload();
+}
+var btnAll=document.createElement("button");
+btnAll.type="button";
+btnAll.className="emprivacy-btn emprivacy-btn-primary";
+btnAll.appendChild(document.createTextNode("Accept all"));
+btnAll.addEventListener("click",function(){persist(true,true);});
+var btnRej=document.createElement("button");
+btnRej.type="button";
+btnRej.className="emprivacy-btn";
+btnRej.appendChild(document.createTextNode("Reject non-essential"));
+btnRej.addEventListener("click",function(){persist(false,false);});
+var btnCust=document.createElement("button");
+btnCust.type="button";
+btnCust.className="emprivacy-btn";
+btnCust.appendChild(document.createTextNode("Customize"));
+btnCust.addEventListener("click",function(){show(opts);btnSave.removeAttribute("hidden");});
+var btnSave=document.createElement("button");
+btnSave.type="button";
+btnSave.className="emprivacy-btn emprivacy-btn-primary";
+btnSave.setAttribute("hidden","");
+btnSave.appendChild(document.createTextNode("Save choices"));
+btnSave.addEventListener("click",function(){persist(!!er.box.checked,!!mr.box.checked);});
+actions.appendChild(btnAll);
+actions.appendChild(btnRej);
+actions.appendChild(btnCust);
+actions.appendChild(btnSave);
+bar.appendChild(title);
+bar.appendChild(msg);
+bar.appendChild(links);
+bar.appendChild(opts);
+bar.appendChild(actions);
+root.appendChild(bar);
+}
+if(document.readyState==="loading")document.addEventListener("DOMContentLoaded",mount);
+else mount();
+})();`;
+}
+/**
+* Native EmDash runtime — loaded via the named `createPlugin` export.
+* Uses `page:fragments`, which requires trusted in-process (native) execution.
+*/
+function createPlugin() {
+	return definePlugin({
+		id: PLUGIN_ID,
+		version: VERSION,
+		capabilities: ["hooks.page-fragments:register"],
+		storage: { consentEvents: { indexes: ["createdAt", "policyVersion"] } },
+		admin: { pages: [{
+			path: ADMIN_SETTINGS_PATH,
+			label: "EmPrivacy",
+			icon: "shield"
+		}] },
+		hooks: {
+			"plugin:install": async (_e, ctx) => {
+				if (!await ctx.kv.get(KV_KEY)) {
+					await saveConfigString(ctx, JSON.stringify(normalizeConfig({})));
+					ctx.log.info("EmPrivacy: seeded default configuration");
+				}
+			},
+			"page:metadata": { handler: async (_e, ctx) => {
+				const cfg = await loadConfig(ctx);
+				const out = [];
+				const privacyHref = absolutePolicyHref(cfg.privacyPolicyUrl, ctx);
+				if (privacyHref) out.push({
+					kind: "link",
+					rel: "site.standard.document",
+					href: privacyHref,
+					key: "emprivacy:privacy"
+				});
+				const cookieHref = cfg.cookiePolicyUrl ? absolutePolicyHref(cfg.cookiePolicyUrl, ctx) : null;
+				if (cookieHref) out.push({
+					kind: "meta",
+					name: "cookie-policy",
+					content: cookieHref,
+					key: "emprivacy:cookie-meta"
+				});
+				return out.length ? out : null;
+			} },
+			"page:fragments": { handler: async (_e, ctx) => {
+				const cfg = await loadConfig(ctx);
+				const privacyResolved = absolutePolicyHref(cfg.privacyPolicyUrl, ctx) ?? "";
+				const cookieResolved = cfg.cookiePolicyUrl ? absolutePolicyHref(cfg.cookiePolicyUrl, ctx) ?? "" : "";
+				const pr = {
+					bannerTitle: cfg.bannerTitle,
+					bannerMessage: cfg.bannerMessage,
+					privacyPolicyUrl: privacyResolved,
+					cookiePolicyUrl: cookieResolved,
+					strictDefaults: cfg.strictDefaults,
+					policyVersion: cfg.policyVersion,
+					analyticsProvider: cfg.analyticsProvider,
+					cloudflareToken: cfg.cloudflareWebAnalyticsToken,
+					analyticsScriptUrls: cfg.analyticsScriptUrls,
+					marketingScriptUrls: cfg.marketingScriptUrls,
+					googleConsentMode: cfg.googleConsentMode,
+					logConsent: cfg.logConsentToServer,
+					recordPath: recordPathForSite()
+				};
+				const style = {
+					kind: "html",
+					placement: "body:end",
+					key: "emprivacy:style",
+					html: `<style id="emprivacy-style">
+#emprivacy-root{font-family:system-ui,sans-serif;font-size:14px}
+.emprivacy-bar{position:fixed;z-index:99999;left:0;right:0;bottom:0;background:#111;color:#eee;padding:16px 20px 20px;box-shadow:0 -4px 24px rgba(0,0,0,.25);max-height:45vh;overflow:auto}
+.emprivacy-title{margin:0 0 8px;font-size:1.1rem}
+.emprivacy-msg{margin:0 0 10px;line-height:1.4;opacity:.95}
+.emprivacy-links a{color:#8ecbff;margin-right:12px}
+.emprivacy-opts{margin:10px 0;border-top:1px solid #333;padding-top:10px}
+.emprivacy-switch{display:block;margin:6px 0}
+.emprivacy-actions{display:flex;flex-wrap:wrap;gap:8px;margin-top:10px}
+.emprivacy-btn{border-radius:6px;border:1px solid #555;background:#222;color:#eee;padding:8px 12px;cursor:pointer}
+.emprivacy-btn-primary{background:#3b82f6;border-color:#3b82f6;color:#fff}
+.emprivacy-cookie-trigger{position:fixed;z-index:99998;left:16px;bottom:16px;width:48px;height:48px;border-radius:50%;border:1px solid #555;background:#222;color:#e8b86d;box-shadow:0 2px 12px rgba(0,0,0,.2);cursor:pointer;padding:0;display:flex;align-items:center;justify-content:center}
+.emprivacy-cookie-trigger:hover{background:#2a2a2a}
+.emprivacy-cookie-trigger:focus{outline:2px solid #3b82f6;outline-offset:2px}
+.emprivacy-cookie-trigger[hidden]{display:none!important}
+.emprivacy-cookie-trigger-icon{font-size:1.35rem;line-height:1}
+.emprivacy-bar--reopen{z-index:100000}
+</style>`
+				};
+				const shell = {
+					kind: "html",
+					placement: "body:end",
+					key: "emprivacy:shell",
+					html: `<div id="emprivacy-root" data-emprivacy="1"></div>`
+				};
+				const headScripts = [];
+				if (cfg.googleConsentMode) headScripts.push({
+					kind: "inline-script",
+					placement: "head",
+					key: "emprivacy:gcm-default",
+					code: buildGoogleConsentHeadScript()
+				});
+				const boot = {
+					kind: "inline-script",
+					placement: "body:end",
+					key: "emprivacy:boot",
+					code: buildBodyBootstrap(pr)
+				};
+				return [
+					...headScripts,
+					style,
+					shell,
+					boot
+				];
+			} }
+		},
+		routes: {
+			admin: { handler: async (ctx) => {
+				const interaction = ctx.input;
+				if (interaction?.type === "page_load" && interaction.page === ADMIN_SETTINGS_PATH) return buildSettingsPage(ctx);
+				if (interaction?.type === "form_submit" && interaction.action_id === SAVE_ACTION_ID) {
+					const v = interaction.values ?? {};
+					const asBool = (x) => {
+						if (x === true) return true;
+						if (x === false) return false;
+						if (typeof x === "string") return x === "true" || x === "on" || x === "1";
+						return Boolean(x);
+					};
+					try {
+						const next = assertValidSavedConfig({
+							bannerTitle: String(v.banner_title ?? ""),
+							bannerMessage: String(v.banner_message ?? ""),
+							privacyPolicyUrl: String(v.privacy_url ?? ""),
+							cookiePolicyUrl: String(v.cookie_url ?? ""),
+							strictDefaults: asBool(v.strict_defaults),
+							policyVersion: String(v.policy_version ?? ""),
+							analyticsPlatform: String(v.analytics_platform ?? "cloudflare"),
+							cloudflareToken: String(v.cloudflare_token ?? ""),
+							analyticsUrlsText: String(v.analytics_urls ?? ""),
+							marketingUrlsText: String(v.marketing_urls ?? ""),
+							googleConsentMode: asBool(v.google_cm),
+							logConsentToServer: asBool(v.log_server)
+						});
+						await saveConfigString(ctx, JSON.stringify(next));
+						return {
+							...await buildSettingsPage(ctx),
+							toast: {
+								message: "EmPrivacy settings saved.",
+								type: "success"
+							}
+						};
+					} catch (e) {
+						const msg = e instanceof Error ? e.message : "Save failed.";
+						return {
+							...await buildSettingsPage(ctx),
+							toast: {
+								message: msg,
+								type: "error"
+							}
+						};
+					}
+				}
+				return { blocks: [] };
+			} },
+			record: {
+				public: true,
+				input: recordInput,
+				handler: async (ctx) => {
+					if (ctx.request.method !== "POST") return { ok: false };
+					try {
+						const origin = ctx.request.headers.get("origin");
+						if (origin) {
+							if (origin !== new URL(ctx.url("/")).origin) return new Response("forbidden", { status: 403 });
+						}
+					} catch {
+						return new Response("bad_request", { status: 400 });
+					}
+					if (!(ctx.request.headers.get("content-type") ?? "").toLowerCase().includes("application/json")) return new Response("unsupported_media_type", { status: 415 });
+					const cfg = await loadConfig(ctx);
+					if (!cfg.logConsentToServer) return {
+						ok: false,
+						reason: "logging_disabled"
+					};
+					const input = ctx.input;
+					if (input.policyVersion !== cfg.policyVersion) return new Response("policy_version_mismatch", { status: 400 });
+					const row = {
+						createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+						policyVersion: input.policyVersion,
+						analytics: input.analytics,
+						marketing: input.marketing
+					};
+					try {
+						if ((await ctx.storage.consentEvents.query({
+							orderBy: { createdAt: "desc" },
+							limit: 500
+						})).items.length >= 500) return {
+							ok: false,
+							reason: "log_full"
+						};
+					} catch {}
+					await ctx.storage.consentEvents.put(`${Date.now()}-${Math.random().toString(36).slice(2)}`, row);
+					return { ok: true };
+				}
+			}
+		}
+	});
+}
+async function buildSettingsPage(ctx) {
+	const cfg = await loadConfig(ctx);
+	const analyticsText = cfg.analyticsScriptUrls.join("\n");
+	const marketingText = cfg.marketingScriptUrls.join("\n");
+	const platform = cfg.analyticsProvider;
+	const docsUrl = "https://github.com/EmPlugins/EmPrivacy/blob/main/docs/PLUGIN_SETTINGS.md";
+	const consentFields = await (async () => {
+		try {
+			return (await ctx.storage.consentEvents.query({
+				orderBy: { createdAt: "desc" },
+				limit: 15
+			})).items.map((item) => {
+				const d = item.data;
+				return {
+					label: d.createdAt,
+					value: `policy ${d.policyVersion} · analytics ${d.analytics ? "on" : "off"} · marketing ${d.marketing ? "on" : "off"}`
+				};
+			});
+		} catch {
+			return [];
+		}
+	})();
+	return { blocks: [
+		{
+			type: "header",
+			text: "EmPrivacy — Cookie & consent"
+		},
+		{
+			type: "context",
+			text: `Documentation: ${docsUrl}`
+		},
+		{
+			type: "context",
+			text: "Configure the public banner. **Analytics:** pick a platform (Cloudflare is built in — enter your **site token** from Cloudflare → Web Analytics; EmPrivacy injects the standard beacon with `data-cf-beacon` after consent). **None** = no third-party analytics scripts. **Custom** = one `https://` script URL per line, `src` only. **Marketing:** `https` script URLs, one per line, after marketing consent. No arbitrary admin HTML in the public site."
+		},
+		{
+			type: "context",
+			text: "Privacy / cookie links: use your EmDash **Page** public path (e.g. `/privacy` — same as in the browser address bar when you view that Page) or a full `https://…` URL if the policy is hosted elsewhere."
+		},
+		{ type: "divider" },
+		{
+			type: "form",
+			blockId: "emprivacy-form",
+			fields: [
+				{
+					type: "text_input",
+					action_id: "banner_title",
+					label: "Banner title",
+					initial_value: cfg.bannerTitle
+				},
+				{
+					type: "text_input",
+					action_id: "banner_message",
+					label: "Short notice",
+					multiline: true,
+					initial_value: cfg.bannerMessage
+				},
+				{
+					type: "text_input",
+					action_id: "privacy_url",
+					label: "Privacy policy — EmDash Page path or https URL",
+					placeholder: "/privacy or https://…",
+					initial_value: cfg.privacyPolicyUrl
+				},
+				{
+					type: "text_input",
+					action_id: "cookie_url",
+					label: "Cookie policy (optional) — path or https URL",
+					placeholder: "/cookies or https://…",
+					initial_value: cfg.cookiePolicyUrl || ""
+				},
+				{
+					type: "text_input",
+					action_id: "policy_version",
+					label: "Policy / consent version",
+					initial_value: cfg.policyVersion
+				},
+				{
+					type: "toggle",
+					action_id: "strict_defaults",
+					label: "Strict defaults (require opt-in for analytics & marketing)",
+					initial_value: cfg.strictDefaults
+				},
+				{
+					type: "radio",
+					action_id: "analytics_platform",
+					label: "Analytics platform",
+					options: [
+						{
+							value: "cloudflare",
+							label: "Cloudflare Web Analytics"
+						},
+						{
+							value: "none",
+							label: "None"
+						},
+						{
+							value: "custom",
+							label: "Custom (https script URLs, one per line)"
+						}
+					],
+					initial_value: platform
+				},
+				{
+					type: "text_input",
+					action_id: "cloudflare_token",
+					label: "Cloudflare Web Analytics site token",
+					placeholder: "Token from Web Analytics in the Cloudflare dashboard",
+					initial_value: cfg.cloudflareWebAnalyticsToken,
+					condition: {
+						field: "analytics_platform",
+						eq: "cloudflare"
+					}
+				},
+				{
+					type: "text_input",
+					action_id: "analytics_urls",
+					label: "Custom analytics script URLs (one https URL per line, not a <script> tag)",
+					placeholder: "https://… (one per line)",
+					multiline: true,
+					initial_value: analyticsText,
+					condition: {
+						field: "analytics_platform",
+						eq: "custom"
+					}
+				},
+				{
+					type: "text_input",
+					action_id: "marketing_urls",
+					label: "Marketing script URLs (one https URL per line, not a <script> tag)",
+					placeholder: "https://… (one per line)",
+					multiline: true,
+					initial_value: marketingText
+				},
+				{
+					type: "toggle",
+					action_id: "google_cm",
+					label: "Google Consent Mode v2 (denied defaults in head; updates after choice)",
+					initial_value: cfg.googleConsentMode
+				},
+				{
+					type: "toggle",
+					action_id: "log_server",
+					label: "Log consent choices to the server (minimal record; no IP stored)",
+					initial_value: cfg.logConsentToServer
+				}
+			],
+			submit: {
+				label: "Save settings",
+				action_id: SAVE_ACTION_ID
+			}
+		},
+		...cfg.logConsentToServer && consentFields.length > 0 ? [
+			{ type: "divider" },
+			{
+				type: "header",
+				text: "Recent consent records"
+			},
+			{
+				type: "fields",
+				fields: consentFields
+			}
+		] : []
+	] };
+}
 
 //#endregion
 //#region src/index.ts
+var src_default = createPlugin;
 /**
-* EmDash plugin descriptor — add to `plugins: []` in `emdash({ ... })` inside `astro.config`.
-* Requires **trusted** registration so `page:metadata` / `page:fragments` run (sandboxed plugins cannot inject fragments).
+* EmDash native plugin descriptor — add to `plugins: []` in `emdash({ ... })` inside `astro.config`.
+*
+* EmPrivacy uses `page:fragments` (banner + consent scripts), which only runs for **native**
+* plugins registered in `plugins: []`. Do not place this descriptor in `sandboxed: []`.
+* See [Page fragments](https://docs.emdashcms.com/plugins/creating-native-plugins/page-fragments/).
 */
 function emprivacyPlugin() {
 	return {
 		id: PLUGIN_ID,
 		version: VERSION,
-		format: "standard",
-		entrypoint: "@emplugins/emprivacy/sandbox",
-		capabilities: ["hooks.page-fragments:register"],
-		storage: { consentEvents: { indexes: ["createdAt", "policyVersion"] } },
+		format: "native",
+		entrypoint: "@emplugins/emprivacy",
 		adminPages: [{
 			path: "/settings",
 			label: "EmPrivacy",
@@ -26,4 +893,4 @@ function emprivacyPlugin() {
 }
 
 //#endregion
-export { COOKIE_NAME, DEFAULT_CONFIG, KV_KEY, assertValidCloudflareToken, emprivacyPlugin, isRootRelativeSitePath, isValidPolicyHrefInput, normalizeConfig, resolvePolicyHref };
+export { COOKIE_NAME, DEFAULT_CONFIG, KV_KEY, assertValidCloudflareToken, createPlugin, src_default as default, emprivacyPlugin, isRootRelativeSitePath, isValidPolicyHrefInput, normalizeConfig, resolvePolicyHref };