@emplugins/emprivacy 1.0.0 → 2.0.0

package/docs/DEVELOPMENT.md

@@ -6,6 +6,8 @@
 
 Runtime dependencies for the published package are **`zod`** only. **EmDash** is a **peer dependency** (your site installs it). The **`emdash`** package in this repo’s `devDependencies` exists so local `typecheck` and tests can resolve `import … from "emdash"`.
 
+EmPrivacy is a **native** EmDash plugin (`format: "native"`, named `createPlugin()` export), published as **`@emplugins/emprivacy`**. It must be registered in `plugins: []` because it uses `page:fragments`.
+
 ## Package manager
 
 This repo uses **pnpm** (`packageManager` in `package.json`). Install and CI:
@@ -19,18 +21,12 @@ pnpm run build
 
 ## `pnpm audit` and the Kysely override
 
-The `emdash` dev dependency pulls in a SQL stack that historically resolved **`kysely@0.27.x`**, which is affected by advisories (for example [GHSA-wmrf-hv6w-mr66](https://github.com/advisories/GHSA-wmrf-hv6w-mr66) and [GHSA-8cpq-38p9-67gx](https://github.com/advisories/GHSA-8cpq-38p9-67gx)) until patched releases.
+`pnpm run audit` runs **`pnpm audit --prod`**, so it reflects **published runtime** dependencies only (currently `zod`).
 
-**This repository pins a safe Kysely** via `pnpm.overrides` in `package.json` (currently `0.29.2`, above the patched range for known advisories). Regenerate the lockfile with `pnpm install` after changing overrides.
+The full install (including the `emdash` **dev** tree) can report transitive advisories from EmDash’s tooling stack. Those are owned by the site’s EmDash upgrade path, not by EmPrivacy’s published tarball.
 
-- Full dev tree: `pnpm audit` should report **0 vulnerabilities** after a clean `pnpm install --frozen-lockfile`. If upstream `emdash` introduces new transitive advisories, track them here and adjust `pnpm.overrides` when a patched release exists.
-- Production install only: `pnpm audit --omit=dev` reflects **only** published runtime deps (currently `zod`).
+**This repository pins Kysely** via `pnpm.overrides` in `package.json` (currently `0.29.6`, aligned with EmDash 0.38). Regenerate the lockfile with `pnpm install` after changing overrides.
 
 ## Deprecation warnings you may still see
 
-`pnpm install` can still print **deprecated** messages for **transitive** packages **not** maintained by this repo, for example:
-
-- **`prebuild-install`** — pulled in by `better-sqlite3` (used by `emdash`). The [package is deprecated](https://www.npmjs.com/package/prebuild-install) pending upstream changes in native addons.
-- **`node-domexception`** — used under the [libsql / fetch](https://www.npmjs.com/package/node-domexception) client stack; the package is deprecated in favor of native `DOMException` in newer Node.
-
-Those warnings do not imply that EmPrivacy’s own source is outdated; they track **upstream** `emdash` and its dependencies. Re-run `pnpm audit` to confirm there are no known vulnerabilities for your install.
+`pnpm install` can still print **deprecated** messages for **transitive** packages **not** maintained by this repo (for example native-addon helpers under EmDash’s SQLite stack). Those warnings do not imply that EmPrivacy’s own source is outdated; they track **upstream** `emdash` and its dependencies.

package/docs/GETTING_STARTED.md

@@ -13,14 +13,17 @@ This guide is for site builders who want cookie consent working on an **EmDash**
 
 ## Before you begin
 
-1. An EmDash site with `emdash` in `astro.config` ([plugins overview](https://docs.emdashcms.com/plugins/overview/)).
+1. An EmDash site on **`emdash@^0.38.0`** with the EmDash Astro integration in `astro.config` ([plugins overview](https://docs.emdashcms.com/plugins/overview/)).
 2. Ability to edit **`astro.config`** and redeploy (or run locally).
+3. Plan to register EmPrivacy as a **native** plugin (`plugins: []`, not `sandboxed: []`) because it injects public page fragments.
 
 ---
 
 ## Step 1 — Install the package
 
 ```bash
+pnpm add @emplugins/emprivacy
+# or
 npm install @emplugins/emprivacy
 ```
 
@@ -32,13 +35,14 @@ The package is versioned with **semver** on npm; to pin a line, use a range such
 
 Open `astro.config.mjs` (or `.ts`).
 
-1. Import the plugin:
+1. Import the plugin and EmDash integration:
 
    ```ts
+   import emdash from "emdash/astro";
    import { emprivacyPlugin } from "@emplugins/emprivacy";
    ```
 
-2. Add **`emprivacyPlugin()`** to **`emdash({ plugins: [...] })`**. Put **EmPrivacy first** if you use other plugins that inject scripts or metadata.
+2. Add **`emprivacyPlugin()`** to **`emdash({ plugins: [...] })`**. Put **EmPrivacy first** if you use other plugins that inject scripts or metadata. Do **not** put it in `sandboxed: []`.
 
    ```ts
    emdash({
@@ -55,7 +59,7 @@ Open `astro.config.mjs` (or `.ts`).
 
 ## Step 3 — Layout must include EmDash hooks
 
-Your base layout must include EmDash’s head/body injection points (e.g. `<EmDashHead />`, `<EmDashBodyStart />`, `<EmDashBodyEnd />` or your theme’s equivalents). Otherwise the banner may not render. See [EmDash docs](https://docs.emdashcms.com/).
+Your base layout must include EmDash’s head/body injection points (e.g. `<EmDashHead page={page} />`, `<EmDashBodyStart page={page} />`, `<EmDashBodyEnd page={page} />`, usually with `createPublicPageContext` from `emdash/page`). Otherwise the banner may not render. See [Page fragments](https://docs.emdashcms.com/plugins/creating-native-plugins/page-fragments/).
 
 ---
 
@@ -111,7 +115,7 @@ Each line must be a **full https URL** to a `.js` file (the script `src`). **Do
 Run automated checks if you develop the plugin or CI:
 
 ```bash
-npm run typecheck && npm run build && npm test
+pnpm run typecheck && pnpm run build && pnpm test
 ```
 
 For a full staging checklist (banner, strict mode, admin, optional logging, Google), see **[TESTING.md](./TESTING.md)**.
@@ -122,9 +126,9 @@ For a full staging checklist (banner, strict mode, admin, optional logging, Goog
 
 | Problem | What to check |
 |--------|----------------|
-| Nothing appears | EmDash layout missing head/body components; plugin not in `plugins: []`; dev server restarted after config change |
+| Nothing appears | EmDash layout missing head/body components (with `page` context); plugin not in **`plugins: []`** (native — not `sandboxed: []`); dev server restarted after config change |
 | Scripts load before consent | No hard-coded third-party scripts in the theme; EmPrivacy listed **before** those plugins in `plugins` |
-| EmPrivacy missing in admin | Plugin not installed or `astro.config` wrong; check build errors |
+| EmPrivacy missing in admin | Plugin not installed or `astro.config` wrong; check build errors; confirm `format: "native"` / `createPlugin` package version |
 | Save fails on privacy/cookie | Value must be a **root-relative path** (`/something`) or **`https://…`** (not `http://` or a bare hostname) |
 | Save fails: “Invalid … script URL” | For **Custom** analytics or **Marketing** URLs, enter one **https URL** per line (the script `src`), not a `<script>` tag. See [Custom script URLs (not HTML)](#custom-script-urls-not-html) |
 | Privacy link 404 or wrong page | Path must match the live EmDash route (compare with the address bar when viewing that Page) |

package/docs/RELEASE_NOTES.md

@@ -2,26 +2,11 @@
 
 # Unreleased
 
-# @emplugins/emprivacy v1.0.0 (pending Version Packages)
-
-## Breaking
-
-- **npm package renamed** — Install and import **`@emplugins/emprivacy`** ( [emplugins](https://www.npmjs.com/org/emplugins) org ). Legacy unscoped `emprivacy` is no longer the publish target.
-- **Sandbox entrypoint** — Descriptor uses `@emplugins/emprivacy/sandbox` (update only if you referenced the old entry string directly).
-
-## Unchanged
-
-- Runtime plugin id `emprivacy`, cookie `emprivacy_cc`, and API routes.
-- Source repository: [EmPlugins/EmPrivacy](https://github.com/EmPlugins/EmPrivacy).
-
-# emprivacy v0.3.0
-
 ## Changes
 
-- **EmDash `>=0.14.0` required** — peer and dev dependency minimum raised from `^0.9.0`. Sites on EmDash 0.9–0.13 should stay on **emprivacy 0.2.x**.
-- **Plugin entry** — `src/sandbox-entry.ts` now default-exports a bare `{ hooks, routes } satisfies SandboxedPlugin` object (types from `emdash/plugin`), matching EmDash 0.13+ standard-format plugins and `@emdash-cms/plugin-audit-log`. No runtime `definePlugin()` import.
-- **CI** — matrix targets **EmDash `0.14.0`**.
-- **Kysely override** — Bumped to **`0.29.2`** so `npm audit` stays clean with `emdash@0.14.x` (see [docs/DEVELOPMENT.md](DEVELOPMENT.md)).
+- Compatibility: targets **EmDash `^0.38.0`** (tested with **`0.38.0`**); Node.js **`>= 22.16`**.
+- **Native plugin** — Switched from standard/sandbox entry packaging to EmDash’s native contract: `format: "native"`, named **`createPlugin()`** export, single-argument **`RouteContext`** route handlers, and no `./sandbox` export. Register **`emprivacyPlugin()`** from **`@emplugins/emprivacy`** in **`plugins: []`** (required for `page:fragments`).
+- Docs/README updated for scoped package install, `import emdash from "emdash/astro"`, layout page context, and native trust boundary.
 
 # emprivacy v0.2.1
 

package/docs/TESTING.md

@@ -8,15 +8,15 @@ Testing is split into **automated** checks (CI-friendly) and **manual** checks t
 
 | Command | What it verifies |
 |--------|-------------------|
-| `npm run typecheck` | TypeScript types against `emdash` APIs |
-| `npm run build` | Bundles ESM + declarations (`dist/`) |
-| `npm test` | Unit tests for **pure** helpers in `src/config.ts` (validation, normalization, URL list parsing, JSON escaping) |
+| `pnpm run typecheck` | TypeScript types against `emdash` APIs |
+| `pnpm run build` | Bundles ESM + declarations (`dist/`) |
+| `pnpm test` | Unit tests for **pure** helpers in `src/config.ts` (validation, normalization, URL list parsing, JSON escaping) |
 
 These scripts do **not** start EmDash or exercise `page:fragments`, admin routes, or the consent cookie in a browser. They catch regressions in config/save validation and packaging early.
 
 ## Manual integration QA (required before production)
 
-Use a **staging** EmDash **`0.14.0+`** Astro app with `emprivacyPlugin()` in `plugins: []`, layout wires (`EmDashHead` / body components), and the same EmDash version you plan to ship.
+Use a **staging** EmDash Astro app on **`emdash@^0.38.0`** with `emprivacyPlugin()` in **`plugins: []`** (native, not `sandboxed`), layout wires (`EmDashHead` / body components with page context), and the same EmDash version you plan to ship.
 
 Work through the checklist from the main [README](../README.md) (also copied below). Record pass/fail and browser + EmDash versions.
 
@@ -38,15 +38,15 @@ Work through the checklist from the main [README](../README.md) (also copied bel
 ## CI suggestion
 
 ```bash
-npm ci
-npm run typecheck
-npm run build
-npm test
+pnpm install --frozen-lockfile
+pnpm run typecheck
+pnpm run build
+pnpm test
 ```
 
 ## Future improvements (not in v1)
 
-- **Integration tests** against EmDash’s `adaptSandboxEntry` + mock `PluginContext` (heavy; depends on EmDash test utilities if exposed).
+- **Integration tests** against EmDash’s native plugin loader + mock `PluginContext` (heavy; depends on EmDash test utilities if exposed).
 - **E2E** (Playwright) against a minimal EmDash fixture app in CI (slower, higher maintenance).
 
 For most teams, **automated unit tests + staging manual QA** is the right balance.

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "SPDX-License-Identifier: MIT",
   "name": "@emplugins/emprivacy",
-  "version": "1.0.0",
+  "version": "2.0.0",
   "description": "Cookie consent and privacy notices for EmDash (GDPR, CCPA/CIPA-oriented configuration)",
   "type": "module",
   "main": "dist/index.mjs",
@@ -9,8 +9,7 @@
     ".": {
       "import": "./dist/index.mjs",
       "types": "./dist/index.d.mts"
-    },
-    "./sandbox": "./dist/sandbox-entry.mjs"
+    }
   },
   "files": [
     "dist",
@@ -38,14 +37,14 @@
   "license": "MIT",
   "packageManager": "pnpm@9.15.4",
   "peerDependencies": {
-    "emdash": ">=0.14.0"
+    "emdash": "^0.38.0"
   },
   "dependencies": {
-    "zod": "^4.3.5"
+    "zod": "4.5.4"
   },
   "devDependencies": {
     "@changesets/cli": "^2.27.11",
-    "emdash": "^0.29.0",
+    "emdash": "0.38.0",
     "tsdown": "^0.20.3",
     "typescript": "^5.9.3",
     "vitest": "^3.2.4"
@@ -64,16 +63,17 @@
   },
   "pnpm": {
     "overrides": {
-      "kysely": "0.29.2"
+      "kysely": "0.29.6",
+      "zod": "4.5.4"
     }
   },
   "scripts": {
     "sync:version": "node scripts/write-version.mjs",
     "verify:exports": "node scripts/verify-exports.mjs",
-    "build": "tsdown src/index.ts src/sandbox-entry.ts --format esm --dts --clean",
-    "dev": "tsdown src/index.ts src/sandbox-entry.ts --format esm --dts --watch",
+    "build": "tsdown src/index.ts --format esm --dts --clean",
+    "dev": "tsdown src/index.ts --format esm --dts --watch",
     "typecheck": "tsc --noEmit",
-    "audit": "pnpm audit",
+    "audit": "pnpm audit --prod",
     "test": "vitest run",
     "test:watch": "vitest",
     "pack:check": "npm pack --dry-run",
@@ -83,6 +83,6 @@
     "prepublishOnly": "pnpm run sync:version && pnpm run typecheck && pnpm run build && pnpm test && pnpm run verify:exports && pnpm run audit"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=22.16"
   }
 }

package/dist/config-BJ1LHuri.mjs

@@ -1,166 +0,0 @@
-//#region src/config.ts
-/**
-* EmPrivacy KV document (`consent:config`) and shared helpers.
-*/
-const KV_KEY = "consent:config";
-const COOKIE_NAME = "emprivacy_cc";
-const PLUGIN_ID = "emprivacy";
-const DEFAULT_CONFIG = {
-	bannerTitle: "Cookies & privacy",
-	bannerMessage: "We use cookies to run this site and optionally for analytics and marketing. You can accept or customize your choices.",
-	privacyPolicyUrl: "/privacy",
-	cookiePolicyUrl: "",
-	strictDefaults: true,
-	policyVersion: "1",
-	cloudflareWebAnalyticsToken: "",
-	analyticsProvider: "cloudflare",
-	analyticsScriptUrls: [],
-	marketingScriptUrls: [],
-	googleConsentMode: false,
-	logConsentToServer: false
-};
-function hasUnsafeUrlChars(s) {
-	return /[\u0000-\u001F\u007F\s]/.test(s);
-}
-function isHttpsUrl(s) {
-	try {
-		const t = s.trim();
-		if (!t) return false;
-		if (hasUnsafeUrlChars(t)) return false;
-		if (/%0d|%0a|%09|%0b|%0c|%20/i.test(t)) return false;
-		const u = new URL(t);
-		if (u.protocol !== "https:") return false;
-		if (u.username || u.password) return false;
-		return true;
-	} catch {
-		return false;
-	}
-}
-function invalidScriptUrlError(kind, u) {
-	if (u.includes("<") || u.includes(">")) return `Invalid ${kind} script URL (https only). Paste one full https:// URL per line (the script src only), not a <script> tag or HTML comment. Example: https://static.cloudflareinsights.com/beacon.min.js. The invalid line was: ${u}`;
-	return `Invalid ${kind} script URL (https only): ${u}`;
-}
-function isAnalyticsProvider(s) {
-	return s === "cloudflare" || s === "none" || s === "custom";
-}
-/** Reject characters that would break JSON or attributes; allow typical Cloudflare site token strings. */
-function assertValidCloudflareToken(t) {
-	const s = t.trim();
-	if (s.length === 0) return;
-	if (s.length > 256) throw new Error("Cloudflare site token is too long.");
-	if (/[\s<>'"&]/.test(s)) throw new Error("Cloudflare site token contains invalid characters.");
-}
-/**
-* Root-relative public path (EmDash page route), e.g. `/privacy`.
-* Rejects protocol-relative URLs (`//…`) and whitespace.
-*/
-function isRootRelativeSitePath(s) {
-	const t = s.trim();
-	if (t.length === 0) return false;
-	if (!t.startsWith("/")) return false;
-	if (t.startsWith("//")) return false;
-	if (hasUnsafeUrlChars(t)) return false;
-	return true;
-}
-/** For hooks: turn stored path or absolute URL into a public absolute URL. */
-function resolvePolicyHref(stored, ctx) {
-	const t = stored.trim();
-	if (!t) return t;
-	if (isRootRelativeSitePath(t)) return ctx.url(t);
-	return t;
-}
-function isValidPolicyHrefInput(s) {
-	const t = s.trim();
-	if (!t) return false;
-	return isHttpsUrl(t) || isRootRelativeSitePath(t);
-}
-function parseUrlList(text) {
-	const lines = text.split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
-	return [...new Set(lines)];
-}
-function assertLength(label, s, min, max) {
-	const t = s.trim();
-	if (t.length < min) throw new Error(`${label} is required.`);
-	if (t.length > max) throw new Error(`${label} is too long.`);
-}
-function assertOptionalLength(label, s, max) {
-	if (s.trim().length > max) throw new Error(`${label} is too long.`);
-}
-function normalizeConfig(raw) {
-	if (typeof raw !== "object" || raw === null) return { ...DEFAULT_CONFIG };
-	const o = raw;
-	const analytics = Array.isArray(o.analyticsScriptUrls) ? o.analyticsScriptUrls.filter((x) => typeof x === "string") : DEFAULT_CONFIG.analyticsScriptUrls;
-	const marketing = Array.isArray(o.marketingScriptUrls) ? o.marketingScriptUrls.filter((x) => typeof x === "string") : DEFAULT_CONFIG.marketingScriptUrls;
-	const cfTok = typeof o.cloudflareWebAnalyticsToken === "string" ? o.cloudflareWebAnalyticsToken : "";
-	const apCandidate = typeof o.analyticsProvider === "string" ? o.analyticsProvider.trim() : "";
-	let analyticsProvider;
-	if (isAnalyticsProvider(apCandidate)) analyticsProvider = apCandidate;
-	else if (analytics.length > 0) analyticsProvider = "custom";
-	else analyticsProvider = DEFAULT_CONFIG.analyticsProvider;
-	return {
-		bannerTitle: typeof o.bannerTitle === "string" ? o.bannerTitle : DEFAULT_CONFIG.bannerTitle,
-		bannerMessage: typeof o.bannerMessage === "string" ? o.bannerMessage : DEFAULT_CONFIG.bannerMessage,
-		privacyPolicyUrl: typeof o.privacyPolicyUrl === "string" ? o.privacyPolicyUrl : DEFAULT_CONFIG.privacyPolicyUrl,
-		cookiePolicyUrl: typeof o.cookiePolicyUrl === "string" ? o.cookiePolicyUrl : DEFAULT_CONFIG.cookiePolicyUrl,
-		strictDefaults: typeof o.strictDefaults === "boolean" ? o.strictDefaults : DEFAULT_CONFIG.strictDefaults,
-		policyVersion: typeof o.policyVersion === "string" && o.policyVersion.length > 0 ? o.policyVersion : DEFAULT_CONFIG.policyVersion,
-		cloudflareWebAnalyticsToken: cfTok,
-		analyticsProvider,
-		analyticsScriptUrls: analytics,
-		marketingScriptUrls: marketing,
-		googleConsentMode: typeof o.googleConsentMode === "boolean" ? o.googleConsentMode : DEFAULT_CONFIG.googleConsentMode,
-		logConsentToServer: typeof o.logConsentToServer === "boolean" ? o.logConsentToServer : DEFAULT_CONFIG.logConsentToServer
-	};
-}
-/** Validate admin-submitted fields; throws an Error with a short message on failure */
-function assertValidSavedConfig(input) {
-	assertLength("Policy version", input.policyVersion, 1, 64);
-	assertOptionalLength("Banner title", input.bannerTitle, 120);
-	assertOptionalLength("Short notice", input.bannerMessage, 600);
-	const privacyPolicyUrl = input.privacyPolicyUrl.trim();
-	if (!isValidPolicyHrefInput(privacyPolicyUrl)) throw new Error("Privacy policy must be a full https:// URL or a site path to your EmDash Page (e.g. /privacy).");
-	if (privacyPolicyUrl.length > 2048) throw new Error("Privacy policy URL/path is too long.");
-	let cookiePolicyUrl = input.cookiePolicyUrl.trim();
-	if (cookiePolicyUrl && !isValidPolicyHrefInput(cookiePolicyUrl)) throw new Error("Cookie policy must be a valid https:// URL or a root-relative path (e.g. /cookies), or empty.");
-	if (cookiePolicyUrl.length > 2048) throw new Error("Cookie policy URL/path is too long.");
-	if (!cookiePolicyUrl) cookiePolicyUrl = DEFAULT_CONFIG.cookiePolicyUrl;
-	const ap = input.analyticsPlatform.trim() || "cloudflare";
-	if (!isAnalyticsProvider(ap)) throw new Error("Analytics: choose a supported option (Cloudflare, None, or Custom).");
-	const tokenTrim = input.cloudflareToken.trim();
-	if (ap === "cloudflare") assertValidCloudflareToken(tokenTrim);
-	const analyticsScriptUrls = [];
-	if (ap === "custom") {
-		const list = parseUrlList(input.analyticsUrlsText);
-		if (list.length > 50) throw new Error("Analytics script URL list is too long (max 50).");
-		for (const u of list) {
-			if (u.length > 2048) throw new Error(invalidScriptUrlError("analytics", u));
-			if (!isHttpsUrl(u)) throw new Error(invalidScriptUrlError("analytics", u));
-			analyticsScriptUrls.push(u);
-		}
-	}
-	const marketingScriptUrls = [];
-	const mlist = parseUrlList(input.marketingUrlsText);
-	if (mlist.length > 50) throw new Error("Marketing script URL list is too long (max 50).");
-	for (const u of mlist) {
-		if (u.length > 2048) throw new Error(invalidScriptUrlError("marketing", u));
-		if (!isHttpsUrl(u)) throw new Error(invalidScriptUrlError("marketing", u));
-		marketingScriptUrls.push(u);
-	}
-	return normalizeConfig({
-		bannerTitle: input.bannerTitle.trim() || DEFAULT_CONFIG.bannerTitle,
-		bannerMessage: input.bannerMessage.trim() || DEFAULT_CONFIG.bannerMessage,
-		privacyPolicyUrl,
-		cookiePolicyUrl,
-		strictDefaults: input.strictDefaults,
-		policyVersion: input.policyVersion.trim(),
-		analyticsProvider: ap,
-		cloudflareWebAnalyticsToken: ap === "cloudflare" ? tokenTrim : "",
-		analyticsScriptUrls: ap === "custom" ? analyticsScriptUrls : [],
-		marketingScriptUrls,
-		googleConsentMode: input.googleConsentMode,
-		logConsentToServer: input.logConsentToServer
-	});
-}
-
-//#endregion
-export { assertValidCloudflareToken as a, isValidPolicyHrefInput as c, PLUGIN_ID as i, normalizeConfig as l, DEFAULT_CONFIG as n, assertValidSavedConfig as o, KV_KEY as r, isRootRelativeSitePath as s, COOKIE_NAME as t, resolvePolicyHref as u };

package/dist/config-CqOtRoQR.d.mts

@@ -1,63 +0,0 @@
-//#region src/config.d.ts
-/**
- * EmPrivacy KV document (`consent:config`) and shared helpers.
- */
-declare const KV_KEY: "consent:config";
-declare const COOKIE_NAME: "emprivacy_cc";
-/** How analytics scripts are chosen after the user consents to analytics. */
-type AnalyticsProvider = "cloudflare" | "none" | "custom";
-interface EmprivacyConfig {
-  bannerTitle: string;
-  bannerMessage: string;
-  /**
-   * Privacy policy location: full `https://…` URL **or** a root-relative path to an EmDash **Page**
-   * (e.g. `/privacy`) resolved with `ctx.url()` on the server.
-   */
-  privacyPolicyUrl: string;
-  /** Optional cookie policy: same rules as `privacyPolicyUrl` (https URL or path like `/cookies`) */
-  cookiePolicyUrl: string;
-  /** When true, analytics/marketing require explicit opt-in in the UI */
-  strictDefaults: boolean;
-  /** Bump to invalidate client consent cookies and re-show the banner */
-  policyVersion: string;
-  /**
-   * Analytics when `cloudflare` — **site token** from Cloudflare → Web Analytics (injected with `data-cf-beacon`).
-   * Public in the same way as a normal site embed. Empty means no Cloudflare script until a token is saved.
-   */
-  cloudflareWebAnalyticsToken: string;
-  /**
-   * Which analytics load path to use after consent. `cloudflare` = beacon + `cloudflareWebAnalyticsToken`;
-   * `custom` = `analyticsScriptUrls` only; `none` = no third-party analytics scripts.
-   */
-  analyticsProvider: AnalyticsProvider;
-  /** When `analyticsProvider` is `custom`, these https script URLs load after analytics consent. */
-  analyticsScriptUrls: string[];
-  /** Third-party script URLs loaded only after marketing consent (https only) */
-  marketingScriptUrls: string[];
-  /** Emit Google Consent Mode v2 defaults (denied) in head; updates after choice */
-  googleConsentMode: boolean;
-  /** POST consent snapshots to the plugin record route and optional storage */
-  logConsentToServer: boolean;
-}
-declare const DEFAULT_CONFIG: EmprivacyConfig;
-/** Reject characters that would break JSON or attributes; allow typical Cloudflare site token strings. */
-declare function assertValidCloudflareToken(t: string): void;
-/**
- * Root-relative public path (EmDash page route), e.g. `/privacy`.
- * Rejects protocol-relative URLs (`//…`) and whitespace.
- */
-declare function isRootRelativeSitePath(s: string): boolean;
-/** For hooks: turn stored path or absolute URL into a public absolute URL. */
-declare function resolvePolicyHref(stored: string, ctx: {
-  url: (path: string) => string;
-}): string;
-declare function isValidPolicyHrefInput(s: string): boolean;
-declare function normalizeConfig(raw: unknown): EmprivacyConfig;
-interface ConsentRecordPayload {
-  createdAt: string;
-  policyVersion: string;
-  analytics: boolean;
-  marketing: boolean;
-}
-//#endregion
-export { EmprivacyConfig as a, isRootRelativeSitePath as c, resolvePolicyHref as d, DEFAULT_CONFIG as i, isValidPolicyHrefInput as l, COOKIE_NAME as n, KV_KEY as o, ConsentRecordPayload as r, assertValidCloudflareToken as s, AnalyticsProvider as t, normalizeConfig as u };