@emplugins/emprivacy 1.0.0 → 2.1.0

package/docs/TESTING.md

@@ -2,52 +2,50 @@
 
 # Testing EmPrivacy before deploy
 
-Testing is split into **automated** checks (CI-friendly) and **manual** checks that require a running EmDash site, because the plugin integrates with EmDash’s runtime, KV, storage, admin Block Kit, and public page pipeline.
+Testing is split into **automated** checks (CI-friendly) and **manual** checks that require a running EmDash site.
 
 ## Automated (in this repo)
 
 | Command | What it verifies |
 |--------|-------------------|
-| `npm run typecheck` | TypeScript types against `emdash` APIs |
-| `npm run build` | Bundles ESM + declarations (`dist/`) |
-| `npm test` | Unit tests for **pure** helpers in `src/config.ts` (validation, normalization, URL list parsing, JSON escaping) |
+| `pnpm run typecheck` | TypeScript types against `emdash` APIs |
+| `pnpm run build` | Bundles ESM + declarations (`dist/`) |
+| `pnpm test` | Config validation, security helpers (embed/script allowlists, CSRF Origin/Sec-Fetch-Site, cookie TTL, SRI), i18n, theme hex, vendor list (no token leak; GTM=marketing), JSON escaping |
 
-These scripts do **not** start EmDash or exercise `page:fragments`, admin routes, or the consent cookie in a browser. They catch regressions in config/save validation and packaging early.
+These scripts do **not** start EmDash or drive a browser.
 
 ## Manual integration QA (required before production)
 
-Use a **staging** EmDash **`0.14.0+`** Astro app with `emprivacyPlugin()` in `plugins: []`, layout wires (`EmDashHead` / body components), and the same EmDash version you plan to ship.
-
-Work through the checklist from the main [README](../README.md) (also copied below). Record pass/fail and browser + EmDash versions.
+Use a **staging** EmDash Astro app on **`emdash@^0.38.0`** with `emprivacyPlugin()` in **`plugins: []`**, layout wires (`EmDashHead` / body components with page context), and the same EmDash version you plan to ship.
 
 ### Core flows
 
-1. **Banner** — Incognito window: banner appears when there is no `emprivacy_cc` cookie or when **Policy / consent version** in admin does not match the cookie’s `v` field.
-2. **Re-open consent** — After dismissing the banner, confirm a **cookie button** appears (bottom-left). Click it: the same options appear; **Save choices** (or Accept/Reject) reloads the page. After reload, **Network** should list analytics scripts only if analytics is on; turn analytics off, save, reload, and those scripts should not run. If you use **Cloudflare Web Analytics** in admin, after consent confirm `beacon.min.js` loads and the tag includes `data-cf-beacon` with your token.
-3. **Strict defaults** — With strict mode on, deny non-essential and confirm configured analytics/marketing URLs do **not** appear in Network until the user accepts (or enables those categories in Customize).
-4. **Persistence** — After accept, reload: banner stays closed; scripts load according to saved choices (Network tab).
-5. **Admin** — EmPrivacy settings page loads, **Save** persists; public banner text and links match what you saved (after refresh / new request).
-6. **Optional server log** — Enable “Log consent…”; submit consent; confirm a row appears under recent records and `POST /_emdash/api/plugins/emprivacy/record` succeeds (200, `{ ok: true }`) in Network.
-7. **Optional Google Consent Mode** — Enable in admin; verify a denied-default snippet exists in `<head>` before interaction, and updates after choice (see [Google’s Consent Mode docs](https://support.google.com/tagmanager/answer/13695607)).
+1. **Banner** — Incognito: banner appears with no `emprivacy_cc` cookie, when **Policy / consent version** does not match `v`, or when a legacy cookie lacks `f`.
+2. **Categories** — Customize shows Essential (locked on), Functional, Analytics, Marketing. Reject non-essential: no configured analytics/marketing scripts in Network; embeds stay placeholders.
+3. **Re-open** — Cookie button (bottom-left). Save reloads. Turning a category off removes those scripts after reload.
+4. **Presets** — For the platform you ship, confirm the expected host loads only after the correct category (Analytics for most presets; **Marketing** for GTM). Custom/marketing scripts must respect any host allowlist.
+5. **Evil embed plant** — In DevTools, add a placeholder with `data-src="https://evil.example/x"` and grant marketing; assert no iframe is created.
+6. **Embed unlock** — “Allow embeds and load” opens preferences; it must not silently flip categories.
+7. **Embeds** — With `@emdash-cms/plugin-embeds` and EmPrivacy last (or site-level `blockComponents`): a YouTube block is a placeholder first; after allowing the embed category, the iframe `src` is `https://www.youtube-nocookie.com/embed/…`. A junk/javascript URL never becomes an iframe.
+8. **API** — After a choice, `window.emprivacy.get()` returns state; `window.emprivacy.has("analytics")` matches Network.
+9. **i18n** — A `de` (or `fr`) page shows translated buttons when that locale is active.
+10. **Policy pages** — `/privacy` does not show the first-visit overlay when that setting is on; the cookie button still works.
+11. **Admin** — Save persists; **What this site uses** matches vendors; tokens do not appear there or at `/_emdash/api/plugins/emprivacy/vendors`.
+12. **Optional server log** — POST requires matching Origin or `Sec-Fetch-Site: same-origin`; Origin mismatch is 403. Body includes `functional`.
+13. **Optional Google Consent Mode** — Denied defaults in `<head>` before interaction, including `functionality_storage`.
 
 ### Regression triggers
 
-- Bump EmDash minor: re-run manual QA (plugin APIs and admin routing can change).
-- Bump this plugin’s **npm semver** after changing hooks or cookie shape: re-check banner and cookie JSON. Release numbering policy: [RELEASES.md](./RELEASES.md).
+- Bump EmDash minor: re-run manual QA.
+- Cookie JSON or embed allowlist changes: re-check banner, `window.emprivacy`, and a YouTube block.
 
 ## CI suggestion
 
 ```bash
-npm ci
-npm run typecheck
-npm run build
-npm test
+pnpm install --frozen-lockfile
+pnpm run typecheck
+pnpm run build
+pnpm test
 ```
 
-## Future improvements (not in v1)
-
-- **Integration tests** against EmDash’s `adaptSandboxEntry` + mock `PluginContext` (heavy; depends on EmDash test utilities if exposed).
-- **E2E** (Playwright) against a minimal EmDash fixture app in CI (slower, higher maintenance).
-
 For most teams, **automated unit tests + staging manual QA** is the right balance.
-

package/package.json

@@ -1,8 +1,8 @@
 {
   "//": "SPDX-License-Identifier: MIT",
   "name": "@emplugins/emprivacy",
-  "version": "1.0.0",
-  "description": "Cookie consent and privacy notices for EmDash (GDPR, CCPA/CIPA-oriented configuration)",
+  "version": "2.1.0",
+  "description": "Cookie consent, gated embeds, and privacy notices for EmDash (GDPR, CCPA/CIPA-oriented configuration)",
   "type": "module",
   "main": "dist/index.mjs",
   "exports": {
@@ -10,10 +10,11 @@
       "import": "./dist/index.mjs",
       "types": "./dist/index.d.mts"
     },
-    "./sandbox": "./dist/sandbox-entry.mjs"
+    "./astro": "./src/astro/index.ts"
   },
   "files": [
     "dist",
+    "src/astro",
     "README.md",
     "LICENSE",
     "docs/DEVELOPMENT.md",
@@ -38,17 +39,17 @@
   "license": "MIT",
   "packageManager": "pnpm@9.15.4",
   "peerDependencies": {
-    "emdash": ">=0.14.0"
+    "emdash": "^0.38.0"
   },
   "dependencies": {
-    "zod": "^4.3.5"
+    "zod": "4.6.5"
   },
   "devDependencies": {
-    "@changesets/cli": "^2.27.11",
-    "emdash": "^0.29.0",
-    "tsdown": "^0.20.3",
+    "@changesets/cli": "^3.0.3",
+    "emdash": "0.38.0",
+    "tsdown": "^0.23.0",
     "typescript": "^5.9.3",
-    "vitest": "^3.2.4"
+    "vitest": "^5.0.1"
   },
   "repository": {
     "type": "git",
@@ -64,16 +65,17 @@
   },
   "pnpm": {
     "overrides": {
-      "kysely": "0.29.2"
+      "kysely": "0.29.6",
+      "zod": "4.6.5"
     }
   },
   "scripts": {
     "sync:version": "node scripts/write-version.mjs",
     "verify:exports": "node scripts/verify-exports.mjs",
-    "build": "tsdown src/index.ts src/sandbox-entry.ts --format esm --dts --clean",
-    "dev": "tsdown src/index.ts src/sandbox-entry.ts --format esm --dts --watch",
+    "build": "tsdown src/index.ts --format esm --dts --clean",
+    "dev": "tsdown src/index.ts --format esm --dts --watch",
     "typecheck": "tsc --noEmit",
-    "audit": "pnpm audit",
+    "audit": "pnpm audit --prod",
     "test": "vitest run",
     "test:watch": "vitest",
     "pack:check": "npm pack --dry-run",
@@ -83,6 +85,6 @@
     "prepublishOnly": "pnpm run sync:version && pnpm run typecheck && pnpm run build && pnpm test && pnpm run verify:exports && pnpm run audit"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=22.16"
   }
 }

package/src/astro/GatedEmbed.astro

@@ -0,0 +1,70 @@
+---
+// SPDX-License-Identifier: MIT
+import { resolveEmbed } from "./embed-resolve.js";
+
+interface Props {
+	node: {
+		_type?: string;
+		id?: string;
+		poster?: string;
+		title?: string;
+	};
+}
+
+const { node } = Astro.props;
+const resolved = resolveEmbed(node ?? {});
+---
+
+{
+	resolved ? (
+		<div
+			class="emprivacy-embed"
+			data-emprivacy-embed={resolved.kind}
+			data-src={resolved.src}
+			data-mode={resolved.mode}
+			data-label={resolved.label}
+		>
+			{resolved.poster ? (
+				<img class="emprivacy-embed-poster" src={resolved.poster} alt="" width="480" height="270" />
+			) : null}
+			<p class="emprivacy-embed-copy">{resolved.label} is blocked until you allow the matching cookie category.</p>
+			<button type="button" class="emprivacy-embed-btn" data-emprivacy-embed-load>
+				Allow embeds and load
+			</button>
+		</div>
+	) : (
+		<p class="emprivacy-embed-invalid">This embed could not be displayed.</p>
+	)
+}
+
+<style>
+	.emprivacy-embed {
+		display: grid;
+		gap: 0.75rem;
+		place-items: center;
+		padding: 1.25rem;
+		border: 1px solid color-mix(in srgb, currentColor 20%, transparent);
+		border-radius: 8px;
+		background: color-mix(in srgb, currentColor 6%, transparent);
+		text-align: center;
+		aspect-ratio: 16 / 9;
+	}
+	.emprivacy-embed-poster {
+		max-width: 100%;
+		height: auto;
+		border-radius: 6px;
+	}
+	.emprivacy-embed-copy,
+	.emprivacy-embed-invalid {
+		margin: 0;
+		max-width: 36rem;
+	}
+	.emprivacy-embed-btn {
+		border-radius: 6px;
+		border: 1px solid currentColor;
+		background: transparent;
+		color: inherit;
+		padding: 0.5rem 0.85rem;
+		cursor: pointer;
+	}
+</style>

package/src/astro/embed-resolve.ts

@@ -0,0 +1,227 @@
+// SPDX-License-Identifier: MIT
+
+/**
+ * Validate official EmDash embed block payloads and produce a first-party
+ * placeholder plan. Never returns a URL we did not construct or allowlist.
+ */
+
+export const EMBED_BLOCK_TYPES = [
+	"youtube",
+	"vimeo",
+	"tweet",
+	"bluesky",
+	"mastodon",
+	"linkPreview",
+	"gist",
+] as const;
+
+export type EmbedBlockType = (typeof EMBED_BLOCK_TYPES)[number];
+
+export type EmbedRenderMode = "iframe" | "link";
+
+export interface ResolvedEmbed {
+	kind: EmbedBlockType;
+	mode: EmbedRenderMode;
+	/** https iframe src or link href — always produced by this module */
+	src: string;
+	label: string;
+	poster: string | null;
+}
+
+const YT_ID = /^[A-Za-z0-9_-]{11}$/;
+const VIMEO_ID = /^\d{6,12}$/;
+const TWEET_ID = /^\d{5,20}$/;
+const BSKY_RKEY = /^[a-z0-9]{1,32}$/i;
+const BSKY_HANDLE = /^[a-z0-9.-]{1,253}$/i;
+const GIST_ID = /^[a-f0-9]{8,64}$/i;
+const GIST_USER = /^[A-Za-z0-9-]{1,39}$/;
+
+const YT_HOSTS = new Set(["youtube.com", "www.youtube.com", "m.youtube.com", "youtu.be", "www.youtube-nocookie.com", "youtube-nocookie.com"]);
+const VIMEO_HOSTS = new Set(["vimeo.com", "www.vimeo.com", "player.vimeo.com"]);
+const TWEET_HOSTS = new Set(["twitter.com", "www.twitter.com", "x.com", "www.x.com", "mobile.twitter.com"]);
+const BSKY_HOSTS = new Set(["bsky.app", "www.bsky.app"]);
+const GIST_HOSTS = new Set(["gist.github.com"]);
+const POSTER_HOSTS = new Set(["i.ytimg.com", "img.youtube.com", "i.vimeocdn.com"]);
+
+function hasUnsafeChars(s: string): boolean {
+	return /[\u0000-\u001F\u007F\s]/.test(s);
+}
+
+export function parseHttpsUrl(raw: string): URL | null {
+	const t = raw.trim();
+	if (!t || t.length > 2048 || hasUnsafeChars(t)) return null;
+	if (/%0d|%0a|%09|%0b|%0c|%20/i.test(t)) return null;
+	try {
+		const u = new URL(t);
+		if (u.protocol !== "https:") return null;
+		if (u.username || u.password) return null;
+		if (u.hostname === "localhost" || u.hostname.endsWith(".localhost")) return null;
+		return u;
+	} catch {
+		return null;
+	}
+}
+
+function hostOf(u: URL): string {
+	return u.hostname.toLowerCase();
+}
+
+function youtubeId(raw: string): string | null {
+	const t = raw.trim();
+	if (YT_ID.test(t)) return t;
+	const u = parseHttpsUrl(t);
+	if (!u || !YT_HOSTS.has(hostOf(u))) return null;
+	if (hostOf(u) === "youtu.be") {
+		const id = u.pathname.replace(/^\//, "").split("/")[0] ?? "";
+		return YT_ID.test(id) ? id : null;
+	}
+	const v = u.searchParams.get("v");
+	if (v && YT_ID.test(v)) return v;
+	const parts = u.pathname.split("/").filter(Boolean);
+	const embedIdx = parts.indexOf("embed");
+	if (embedIdx >= 0) {
+		const id = parts[embedIdx + 1] ?? "";
+		return YT_ID.test(id) ? id : null;
+	}
+	const shortsIdx = parts.indexOf("shorts");
+	if (shortsIdx >= 0) {
+		const id = parts[shortsIdx + 1] ?? "";
+		return YT_ID.test(id) ? id : null;
+	}
+	return null;
+}
+
+function vimeoId(raw: string): string | null {
+	const t = raw.trim();
+	if (VIMEO_ID.test(t)) return t;
+	const u = parseHttpsUrl(t);
+	if (!u || !VIMEO_HOSTS.has(hostOf(u))) return null;
+	const parts = u.pathname.split("/").filter(Boolean);
+	const last = parts[parts.length - 1] ?? "";
+	const videoIdx = parts.indexOf("video");
+	if (videoIdx >= 0) {
+		const id = parts[videoIdx + 1] ?? "";
+		return VIMEO_ID.test(id) ? id : null;
+	}
+	return VIMEO_ID.test(last) ? last : null;
+}
+
+function tweetId(raw: string): string | null {
+	const t = raw.trim();
+	if (TWEET_ID.test(t)) return t;
+	const u = parseHttpsUrl(t);
+	if (!u || !TWEET_HOSTS.has(hostOf(u))) return null;
+	const m = /\/status(?:es)?\/(\d{5,20})(?:\/|$)/i.exec(u.pathname);
+	return m?.[1] ?? null;
+}
+
+function blueskyHref(raw: string): string | null {
+	const u = parseHttpsUrl(raw);
+	if (!u || !BSKY_HOSTS.has(hostOf(u))) return null;
+	const m = /^\/profile\/([^/]+)\/post\/([^/]+)\/?$/.exec(u.pathname);
+	if (!m) return null;
+	const handle = m[1] ?? "";
+	const rkey = m[2] ?? "";
+	if (!BSKY_HANDLE.test(handle) || !BSKY_RKEY.test(rkey)) return null;
+	return `https://bsky.app/profile/${handle}/post/${rkey}`;
+}
+
+function gistHref(raw: string): string | null {
+	const u = parseHttpsUrl(raw);
+	if (!u || !GIST_HOSTS.has(hostOf(u))) return null;
+	const parts = u.pathname.split("/").filter(Boolean);
+	if (parts.length < 2) return null;
+	const user = parts[0] ?? "";
+	const id = (parts[1] ?? "").replace(/\.js$/i, "");
+	if (!GIST_USER.test(user) || !GIST_ID.test(id)) return null;
+	return `https://gist.github.com/${user}/${id}`;
+}
+
+function mastodonHref(raw: string): string | null {
+	const u = parseHttpsUrl(raw);
+	if (!u) return null;
+	// Any Mastodon instance is an arbitrary host — never iframe it.
+	if (!/^\/@[^/]+\/\d+\/?$/.test(u.pathname) && !/^\/users\/[^/]+\/statuses\/\d+\/?$/.test(u.pathname)) {
+		return null;
+	}
+	return `https://${hostOf(u)}${u.pathname.replace(/\/$/, "")}`;
+}
+
+function posterUrl(raw: unknown, kind: EmbedBlockType, mediaId: string | null): string | null {
+	if (kind === "youtube" && mediaId && YT_ID.test(mediaId)) {
+		return `https://i.ytimg.com/vi/${mediaId}/hqdefault.jpg`;
+	}
+	if (typeof raw !== "string") return null;
+	const u = parseHttpsUrl(raw);
+	if (!u || !POSTER_HOSTS.has(hostOf(u))) return null;
+	return u.href;
+}
+
+export function isEmbedBlockType(s: string): s is EmbedBlockType {
+	return (EMBED_BLOCK_TYPES as readonly string[]).includes(s);
+}
+
+export function resolveEmbed(node: {
+	_type?: unknown;
+	id?: unknown;
+	poster?: unknown;
+	title?: unknown;
+}): ResolvedEmbed | null {
+	if (!node || typeof node._type !== "string" || !isEmbedBlockType(node._type)) return null;
+	if (typeof node.id !== "string") return null;
+	const kind = node._type;
+	const rawId = node.id.trim();
+	if (!rawId || rawId.length > 2048) return null;
+
+	if (kind === "youtube") {
+		const id = youtubeId(rawId);
+		if (!id) return null;
+		return {
+			kind,
+			mode: "iframe",
+			src: `https://www.youtube-nocookie.com/embed/${id}`,
+			label: "YouTube",
+			poster: posterUrl(node.poster, kind, id),
+		};
+	}
+	if (kind === "vimeo") {
+		const id = vimeoId(rawId);
+		if (!id) return null;
+		return {
+			kind,
+			mode: "iframe",
+			src: `https://player.vimeo.com/video/${id}`,
+			label: "Vimeo",
+			poster: posterUrl(node.poster, kind, id),
+		};
+	}
+	if (kind === "tweet") {
+		const id = tweetId(rawId);
+		if (!id) return null;
+		return {
+			kind,
+			mode: "link",
+			src: `https://x.com/i/web/status/${id}`,
+			label: "Post on X",
+			poster: null,
+		};
+	}
+	if (kind === "bluesky") {
+		const href = blueskyHref(rawId);
+		if (!href) return null;
+		return { kind, mode: "link", src: href, label: "Bluesky post", poster: null };
+	}
+	if (kind === "mastodon") {
+		const href = mastodonHref(rawId);
+		if (!href) return null;
+		return { kind, mode: "link", src: href, label: "Mastodon post", poster: null };
+	}
+	if (kind === "gist") {
+		const href = gistHref(rawId);
+		if (!href) return null;
+		return { kind, mode: "link", src: href, label: "GitHub Gist", poster: null };
+	}
+	const href = parseHttpsUrl(rawId);
+	if (!href) return null;
+	return { kind: "linkPreview", mode: "link", src: href.href, label: href.hostname, poster: null };
+}

package/src/astro/index.ts

@@ -0,0 +1,24 @@
+// SPDX-License-Identifier: MIT
+
+/**
+ * Portable Text renderers that replace official EmDash embed blocks with
+ * consent-gated placeholders. Import from `@emplugins/emprivacy/astro`.
+ *
+ * Later plugins in `plugins: []` win. To force these wrappers regardless of
+ * registration order, pass `blockComponents` to `<PortableText />`.
+ */
+
+import GatedEmbed from "./GatedEmbed.astro";
+
+export const blockComponents = {
+	youtube: GatedEmbed,
+	vimeo: GatedEmbed,
+	tweet: GatedEmbed,
+	bluesky: GatedEmbed,
+	mastodon: GatedEmbed,
+	linkPreview: GatedEmbed,
+	gist: GatedEmbed,
+};
+
+export { GatedEmbed };
+export { blockComponents as emprivacyEmbedComponents };

package/dist/config-BJ1LHuri.mjs

@@ -1,166 +0,0 @@
-//#region src/config.ts
-/**
-* EmPrivacy KV document (`consent:config`) and shared helpers.
-*/
-const KV_KEY = "consent:config";
-const COOKIE_NAME = "emprivacy_cc";
-const PLUGIN_ID = "emprivacy";
-const DEFAULT_CONFIG = {
-	bannerTitle: "Cookies & privacy",
-	bannerMessage: "We use cookies to run this site and optionally for analytics and marketing. You can accept or customize your choices.",
-	privacyPolicyUrl: "/privacy",
-	cookiePolicyUrl: "",
-	strictDefaults: true,
-	policyVersion: "1",
-	cloudflareWebAnalyticsToken: "",
-	analyticsProvider: "cloudflare",
-	analyticsScriptUrls: [],
-	marketingScriptUrls: [],
-	googleConsentMode: false,
-	logConsentToServer: false
-};
-function hasUnsafeUrlChars(s) {
-	return /[\u0000-\u001F\u007F\s]/.test(s);
-}
-function isHttpsUrl(s) {
-	try {
-		const t = s.trim();
-		if (!t) return false;
-		if (hasUnsafeUrlChars(t)) return false;
-		if (/%0d|%0a|%09|%0b|%0c|%20/i.test(t)) return false;
-		const u = new URL(t);
-		if (u.protocol !== "https:") return false;
-		if (u.username || u.password) return false;
-		return true;
-	} catch {
-		return false;
-	}
-}
-function invalidScriptUrlError(kind, u) {
-	if (u.includes("<") || u.includes(">")) return `Invalid ${kind} script URL (https only). Paste one full https:// URL per line (the script src only), not a <script> tag or HTML comment. Example: https://static.cloudflareinsights.com/beacon.min.js. The invalid line was: ${u}`;
-	return `Invalid ${kind} script URL (https only): ${u}`;
-}
-function isAnalyticsProvider(s) {
-	return s === "cloudflare" || s === "none" || s === "custom";
-}
-/** Reject characters that would break JSON or attributes; allow typical Cloudflare site token strings. */
-function assertValidCloudflareToken(t) {
-	const s = t.trim();
-	if (s.length === 0) return;
-	if (s.length > 256) throw new Error("Cloudflare site token is too long.");
-	if (/[\s<>'"&]/.test(s)) throw new Error("Cloudflare site token contains invalid characters.");
-}
-/**
-* Root-relative public path (EmDash page route), e.g. `/privacy`.
-* Rejects protocol-relative URLs (`//…`) and whitespace.
-*/
-function isRootRelativeSitePath(s) {
-	const t = s.trim();
-	if (t.length === 0) return false;
-	if (!t.startsWith("/")) return false;
-	if (t.startsWith("//")) return false;
-	if (hasUnsafeUrlChars(t)) return false;
-	return true;
-}
-/** For hooks: turn stored path or absolute URL into a public absolute URL. */
-function resolvePolicyHref(stored, ctx) {
-	const t = stored.trim();
-	if (!t) return t;
-	if (isRootRelativeSitePath(t)) return ctx.url(t);
-	return t;
-}
-function isValidPolicyHrefInput(s) {
-	const t = s.trim();
-	if (!t) return false;
-	return isHttpsUrl(t) || isRootRelativeSitePath(t);
-}
-function parseUrlList(text) {
-	const lines = text.split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
-	return [...new Set(lines)];
-}
-function assertLength(label, s, min, max) {
-	const t = s.trim();
-	if (t.length < min) throw new Error(`${label} is required.`);
-	if (t.length > max) throw new Error(`${label} is too long.`);
-}
-function assertOptionalLength(label, s, max) {
-	if (s.trim().length > max) throw new Error(`${label} is too long.`);
-}
-function normalizeConfig(raw) {
-	if (typeof raw !== "object" || raw === null) return { ...DEFAULT_CONFIG };
-	const o = raw;
-	const analytics = Array.isArray(o.analyticsScriptUrls) ? o.analyticsScriptUrls.filter((x) => typeof x === "string") : DEFAULT_CONFIG.analyticsScriptUrls;
-	const marketing = Array.isArray(o.marketingScriptUrls) ? o.marketingScriptUrls.filter((x) => typeof x === "string") : DEFAULT_CONFIG.marketingScriptUrls;
-	const cfTok = typeof o.cloudflareWebAnalyticsToken === "string" ? o.cloudflareWebAnalyticsToken : "";
-	const apCandidate = typeof o.analyticsProvider === "string" ? o.analyticsProvider.trim() : "";
-	let analyticsProvider;
-	if (isAnalyticsProvider(apCandidate)) analyticsProvider = apCandidate;
-	else if (analytics.length > 0) analyticsProvider = "custom";
-	else analyticsProvider = DEFAULT_CONFIG.analyticsProvider;
-	return {
-		bannerTitle: typeof o.bannerTitle === "string" ? o.bannerTitle : DEFAULT_CONFIG.bannerTitle,
-		bannerMessage: typeof o.bannerMessage === "string" ? o.bannerMessage : DEFAULT_CONFIG.bannerMessage,
-		privacyPolicyUrl: typeof o.privacyPolicyUrl === "string" ? o.privacyPolicyUrl : DEFAULT_CONFIG.privacyPolicyUrl,
-		cookiePolicyUrl: typeof o.cookiePolicyUrl === "string" ? o.cookiePolicyUrl : DEFAULT_CONFIG.cookiePolicyUrl,
-		strictDefaults: typeof o.strictDefaults === "boolean" ? o.strictDefaults : DEFAULT_CONFIG.strictDefaults,
-		policyVersion: typeof o.policyVersion === "string" && o.policyVersion.length > 0 ? o.policyVersion : DEFAULT_CONFIG.policyVersion,
-		cloudflareWebAnalyticsToken: cfTok,
-		analyticsProvider,
-		analyticsScriptUrls: analytics,
-		marketingScriptUrls: marketing,
-		googleConsentMode: typeof o.googleConsentMode === "boolean" ? o.googleConsentMode : DEFAULT_CONFIG.googleConsentMode,
-		logConsentToServer: typeof o.logConsentToServer === "boolean" ? o.logConsentToServer : DEFAULT_CONFIG.logConsentToServer
-	};
-}
-/** Validate admin-submitted fields; throws an Error with a short message on failure */
-function assertValidSavedConfig(input) {
-	assertLength("Policy version", input.policyVersion, 1, 64);
-	assertOptionalLength("Banner title", input.bannerTitle, 120);
-	assertOptionalLength("Short notice", input.bannerMessage, 600);
-	const privacyPolicyUrl = input.privacyPolicyUrl.trim();
-	if (!isValidPolicyHrefInput(privacyPolicyUrl)) throw new Error("Privacy policy must be a full https:// URL or a site path to your EmDash Page (e.g. /privacy).");
-	if (privacyPolicyUrl.length > 2048) throw new Error("Privacy policy URL/path is too long.");
-	let cookiePolicyUrl = input.cookiePolicyUrl.trim();
-	if (cookiePolicyUrl && !isValidPolicyHrefInput(cookiePolicyUrl)) throw new Error("Cookie policy must be a valid https:// URL or a root-relative path (e.g. /cookies), or empty.");
-	if (cookiePolicyUrl.length > 2048) throw new Error("Cookie policy URL/path is too long.");
-	if (!cookiePolicyUrl) cookiePolicyUrl = DEFAULT_CONFIG.cookiePolicyUrl;
-	const ap = input.analyticsPlatform.trim() || "cloudflare";
-	if (!isAnalyticsProvider(ap)) throw new Error("Analytics: choose a supported option (Cloudflare, None, or Custom).");
-	const tokenTrim = input.cloudflareToken.trim();
-	if (ap === "cloudflare") assertValidCloudflareToken(tokenTrim);
-	const analyticsScriptUrls = [];
-	if (ap === "custom") {
-		const list = parseUrlList(input.analyticsUrlsText);
-		if (list.length > 50) throw new Error("Analytics script URL list is too long (max 50).");
-		for (const u of list) {
-			if (u.length > 2048) throw new Error(invalidScriptUrlError("analytics", u));
-			if (!isHttpsUrl(u)) throw new Error(invalidScriptUrlError("analytics", u));
-			analyticsScriptUrls.push(u);
-		}
-	}
-	const marketingScriptUrls = [];
-	const mlist = parseUrlList(input.marketingUrlsText);
-	if (mlist.length > 50) throw new Error("Marketing script URL list is too long (max 50).");
-	for (const u of mlist) {
-		if (u.length > 2048) throw new Error(invalidScriptUrlError("marketing", u));
-		if (!isHttpsUrl(u)) throw new Error(invalidScriptUrlError("marketing", u));
-		marketingScriptUrls.push(u);
-	}
-	return normalizeConfig({
-		bannerTitle: input.bannerTitle.trim() || DEFAULT_CONFIG.bannerTitle,
-		bannerMessage: input.bannerMessage.trim() || DEFAULT_CONFIG.bannerMessage,
-		privacyPolicyUrl,
-		cookiePolicyUrl,
-		strictDefaults: input.strictDefaults,
-		policyVersion: input.policyVersion.trim(),
-		analyticsProvider: ap,
-		cloudflareWebAnalyticsToken: ap === "cloudflare" ? tokenTrim : "",
-		analyticsScriptUrls: ap === "custom" ? analyticsScriptUrls : [],
-		marketingScriptUrls,
-		googleConsentMode: input.googleConsentMode,
-		logConsentToServer: input.logConsentToServer
-	});
-}
-
-//#endregion
-export { assertValidCloudflareToken as a, isValidPolicyHrefInput as c, PLUGIN_ID as i, normalizeConfig as l, DEFAULT_CONFIG as n, assertValidSavedConfig as o, KV_KEY as r, isRootRelativeSitePath as s, COOKIE_NAME as t, resolvePolicyHref as u };