@emplugins/emprivacy 2.0.0 → 3.0.0

package/dist/index.mjs

@@ -1,6 +1,407 @@
 import { definePlugin } from "emdash";
 import { z } from "zod";
-
+const LOCALE_KEY = /^[a-z]{2,3}(?:-[A-Za-z]{2})?$/;
+const CHROME = {
+	en: {
+		acceptAll: "Accept all",
+		rejectNonEssential: "Reject non-essential",
+		customize: "Customize",
+		saveChoices: "Save choices",
+		close: "Close",
+		essential: "Essential",
+		functional: "Functional",
+		analytics: "Analytics",
+		marketing: "Marketing",
+		essentialNote: "Always on — needed to run the site and remember this choice.",
+		privacyPolicy: "Privacy policy",
+		cookiePolicy: "Cookie policy",
+		cookieSettings: "Cookie and privacy settings",
+		loadEmbed: "Allow embeds and load",
+		embedBlocked: "This embed is blocked until you allow the matching cookie category.",
+		embedNeedConsent: "To load this embed, allow the matching category in cookie settings.",
+		vendorsHeading: "What this site uses",
+		whatWeUse: "What we use"
+	},
+	de: {
+		acceptAll: "Alle akzeptieren",
+		rejectNonEssential: "Nicht notwendige ablehnen",
+		customize: "Anpassen",
+		saveChoices: "Auswahl speichern",
+		close: "Schließen",
+		essential: "Essenziell",
+		functional: "Funktional",
+		analytics: "Analyse",
+		marketing: "Marketing",
+		essentialNote: "Immer aktiv — erforderlich für die Website und diese Auswahl.",
+		privacyPolicy: "Datenschutzerklärung",
+		cookiePolicy: "Cookie-Richtlinie",
+		cookieSettings: "Cookie- und Datenschutzeinstellungen",
+		loadEmbed: "Einbettungen erlauben und laden",
+		embedBlocked: "Diese Einbettung ist gesperrt, bis Sie die passende Kategorie erlauben.",
+		embedNeedConsent: "Um diese Einbettung zu laden, erlauben Sie die passende Kategorie in den Cookie-Einstellungen.",
+		vendorsHeading: "Was diese Website verwendet",
+		whatWeUse: "Was wir verwenden"
+	},
+	fr: {
+		acceptAll: "Tout accepter",
+		rejectNonEssential: "Refuser les non essentiels",
+		customize: "Personnaliser",
+		saveChoices: "Enregistrer",
+		close: "Fermer",
+		essential: "Essentiels",
+		functional: "Fonctionnels",
+		analytics: "Mesure d’audience",
+		marketing: "Marketing",
+		essentialNote: "Toujours actifs — nécessaires au site et à ce choix.",
+		privacyPolicy: "Politique de confidentialité",
+		cookiePolicy: "Politique cookies",
+		cookieSettings: "Paramètres des cookies et de confidentialité",
+		loadEmbed: "Autoriser les contenus intégrés",
+		embedBlocked: "Ce contenu est bloqué tant que vous n’avez pas autorisé la catégorie correspondante.",
+		embedNeedConsent: "Pour charger ce contenu, autorisez la catégorie correspondante dans les paramètres des cookies.",
+		vendorsHeading: "Ce que ce site utilise",
+		whatWeUse: "Ce que nous utilisons"
+	},
+	es: {
+		acceptAll: "Aceptar todo",
+		rejectNonEssential: "Rechazar no esenciales",
+		customize: "Personalizar",
+		saveChoices: "Guardar",
+		close: "Cerrar",
+		essential: "Esenciales",
+		functional: "Funcionales",
+		analytics: "Analítica",
+		marketing: "Marketing",
+		essentialNote: "Siempre activos — necesarios para el sitio y esta elección.",
+		privacyPolicy: "Política de privacidad",
+		cookiePolicy: "Política de cookies",
+		cookieSettings: "Ajustes de cookies y privacidad",
+		loadEmbed: "Permitir incrustaciones y cargar",
+		embedBlocked: "Este contenido está bloqueado hasta que permita la categoría correspondiente.",
+		embedNeedConsent: "Para cargar este contenido, permita la categoría correspondiente en los ajustes de cookies.",
+		vendorsHeading: "Qué usa este sitio",
+		whatWeUse: "Qué usamos"
+	},
+	it: {
+		acceptAll: "Accetta tutto",
+		rejectNonEssential: "Rifiuta non essenziali",
+		customize: "Personalizza",
+		saveChoices: "Salva",
+		close: "Chiudi",
+		essential: "Essenziali",
+		functional: "Funzionali",
+		analytics: "Statistiche",
+		marketing: "Marketing",
+		essentialNote: "Sempre attivi — necessari al sito e a questa scelta.",
+		privacyPolicy: "Informativa sulla privacy",
+		cookiePolicy: "Informativa cookie",
+		cookieSettings: "Impostazioni cookie e privacy",
+		loadEmbed: "Consenti gli embed e carica",
+		embedBlocked: "Questo contenuto è bloccato finché non consenti la categoria corrispondente.",
+		embedNeedConsent: "Per caricare questo contenuto, consenti la categoria corrispondente nelle impostazioni cookie.",
+		vendorsHeading: "Cosa usa questo sito",
+		whatWeUse: "Cosa usiamo"
+	},
+	nl: {
+		acceptAll: "Alles accepteren",
+		rejectNonEssential: "Niet-essentieel weigeren",
+		customize: "Aanpassen",
+		saveChoices: "Opslaan",
+		close: "Sluiten",
+		essential: "Essentieel",
+		functional: "Functioneel",
+		analytics: "Statistieken",
+		marketing: "Marketing",
+		essentialNote: "Altijd aan — nodig voor de site en deze keuze.",
+		privacyPolicy: "Privacybeleid",
+		cookiePolicy: "Cookiebeleid",
+		cookieSettings: "Cookie- en privacyinstellingen",
+		loadEmbed: "Embeds toestaan en laden",
+		embedBlocked: "Deze embed is geblokkeerd tot u de bijbehorende categorie toestaat.",
+		embedNeedConsent: "Om deze embed te laden, sta de bijbehorende categorie toe in de cookie-instellingen.",
+		vendorsHeading: "Wat deze site gebruikt",
+		whatWeUse: "Wat wij gebruiken"
+	},
+	pt: {
+		acceptAll: "Aceitar tudo",
+		rejectNonEssential: "Recusar não essenciais",
+		customize: "Personalizar",
+		saveChoices: "Guardar",
+		close: "Fechar",
+		essential: "Essenciais",
+		functional: "Funcionais",
+		analytics: "Analítica",
+		marketing: "Marketing",
+		essentialNote: "Sempre ativos — necessários para o site e esta escolha.",
+		privacyPolicy: "Política de privacidade",
+		cookiePolicy: "Política de cookies",
+		cookieSettings: "Definições de cookies e privacidade",
+		loadEmbed: "Permitir embeds e carregar",
+		embedBlocked: "Este conteúdo está bloqueado até autorizar a categoria correspondente.",
+		embedNeedConsent: "Para carregar este conteúdo, autorize a categoria correspondente nas definições de cookies.",
+		vendorsHeading: "O que este site usa",
+		whatWeUse: "O que usamos"
+	},
+	pl: {
+		acceptAll: "Zaakceptuj wszystkie",
+		rejectNonEssential: "Odrzuć niepotrzebne",
+		customize: "Dostosuj",
+		saveChoices: "Zapisz",
+		close: "Zamknij",
+		essential: "Niezbędne",
+		functional: "Funkcjonalne",
+		analytics: "Analityczne",
+		marketing: "Marketingowe",
+		essentialNote: "Zawsze włączone — potrzebne do działania witryny i zapamiętania wyboru.",
+		privacyPolicy: "Polityka prywatności",
+		cookiePolicy: "Polityka cookies",
+		cookieSettings: "Ustawienia plików cookie i prywatności",
+		loadEmbed: "Zezwól na osadzenia i wczytaj",
+		embedBlocked: "Ta treść jest zablokowana, dopóki nie zezwolisz na odpowiednią kategorię.",
+		embedNeedConsent: "Aby wczytać tę treść, zezwól na odpowiednią kategorię w ustawieniach plików cookie.",
+		vendorsHeading: "Czego używa ta witryna",
+		whatWeUse: "Czego używamy"
+	}
+};
+function isLocaleKey(s) {
+	return LOCALE_KEY.test(s.trim());
+}
+/** `de-DE` → `["de-de", "de"]` (case-normalized). */
+function localeFallbackKeys(locale) {
+	if (!locale) return [];
+	const t = locale.trim();
+	if (!t || t.length > 16) return [];
+	const lower = t.toLowerCase();
+	const parts = lower.split("-");
+	const keys = [];
+	if (parts.length >= 2) keys.push(`${parts[0]}-${parts[1]}`);
+	keys.push(parts[0] ?? lower);
+	return keys.filter((k, i, a) => isLocaleKey(k) && a.indexOf(k) === i);
+}
+function chromeForLocale(locale) {
+	for (const key of localeFallbackKeys(locale)) {
+		const found = CHROME[key] ?? CHROME[key.split("-")[0] ?? ""];
+		if (found) return found;
+	}
+	return CHROME["en"];
+}
+function parseLocaleOverrides(raw) {
+	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return {};
+	const out = {};
+	for (const [k, v] of Object.entries(raw)) {
+		if (!isLocaleKey(k)) continue;
+		if (!v || typeof v !== "object" || Array.isArray(v)) continue;
+		const o = v;
+		const entry = {};
+		if (typeof o.bannerTitle === "string") entry.bannerTitle = o.bannerTitle;
+		if (typeof o.bannerMessage === "string") entry.bannerMessage = o.bannerMessage;
+		if (entry.bannerTitle !== void 0 || entry.bannerMessage !== void 0) out[k.toLowerCase()] = entry;
+		if (Object.keys(out).length >= 32) break;
+	}
+	return out;
+}
+function parseLocaleOverridesText(text) {
+	const t = text.trim();
+	if (!t) return {};
+	let parsed;
+	try {
+		parsed = JSON.parse(t);
+	} catch {
+		throw new Error("Translations must be JSON: {\"de\":{\"bannerTitle\":\"…\",\"bannerMessage\":\"…\"}}.");
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error("Translations JSON must be an object keyed by locale (e.g. de, fr).");
+	for (const key of Object.keys(parsed)) if (!isLocaleKey(key)) throw new Error(`Invalid locale key "${key}". Use codes like en, de, or pt-BR.`);
+	return parseLocaleOverrides(parsed);
+}
+function resolveBannerCopy(defaults, overrides, locale) {
+	let title = defaults.bannerTitle;
+	let message = defaults.bannerMessage;
+	for (const key of localeFallbackKeys(locale)) {
+		const o = overrides[key] ?? overrides[key.split("-")[0] ?? ""];
+		if (!o) continue;
+		if (typeof o.bannerTitle === "string" && o.bannerTitle.trim()) title = o.bannerTitle;
+		if (typeof o.bannerMessage === "string" && o.bannerMessage.trim()) message = o.bannerMessage;
+		break;
+	}
+	return {
+		bannerTitle: title,
+		bannerMessage: message
+	};
+}
+//#endregion
+//#region src/ids.ts
+const HOSTNAME$1 = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i;
+const FATHOM_ID = /^[A-Za-z0-9]{4,32}$/;
+const UMAMI_ID = /^[A-Za-z0-9-]{8,64}$/;
+const GA4_ID = /^G-[A-Z0-9]{4,14}$/;
+const GTM_ID = /^GTM-[A-Z0-9]{4,12}$/;
+function isHostname$1(s) {
+	const t = s.trim().toLowerCase();
+	if (!t || t.length > 253) return false;
+	if (t === "localhost" || t.endsWith(".localhost")) return false;
+	return HOSTNAME$1.test(t);
+}
+function isGa4Id(s) {
+	return GA4_ID.test(s.trim());
+}
+function isGtmId(s) {
+	return GTM_ID.test(s.trim());
+}
+function isFathomId(s) {
+	return FATHOM_ID.test(s.trim());
+}
+function isUmamiId(s) {
+	return UMAMI_ID.test(s.trim());
+}
+//#endregion
+//#region src/security.ts
+/** Hosts EmPrivacy may load as <script src> for built-in presets. */
+const PRESET_SCRIPT_HOSTS = /* @__PURE__ */ new Set([
+	"static.cloudflareinsights.com",
+	"plausible.io",
+	"cdn.usefathom.com",
+	"scripts.simpleanalyticscdn.com",
+	"www.googletagmanager.com",
+	"googletagmanager.com"
+]);
+const HOSTNAME = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i;
+function normalizeCookieMaxAgeDays(n, fallback = 180) {
+	if (typeof n !== "number" || !Number.isFinite(n) || n < 1) return fallback;
+	return Math.min(365, Math.max(1, Math.round(n)));
+}
+function parseCookieMaxAgeDays(s, fallback = 180) {
+	const t = s.trim();
+	if (!t) return fallback;
+	if (!/^\d{1,3}$/.test(t)) throw new Error(`Consent cookie lifetime must be 1–365 days.`);
+	const n = Number(t);
+	if (n < 1 || n > 365) throw new Error(`Consent cookie lifetime must be 1–365 days.`);
+	return n;
+}
+function cookieMaxAgeSeconds(days) {
+	return normalizeCookieMaxAgeDays(days) * 24 * 60 * 60;
+}
+function hasUnsafeUrlChars$1(s) {
+	return /[\u0000-\u001F\u007F\s]/.test(s);
+}
+function parseStrictHttpsUrl(raw) {
+	const t = raw.trim();
+	if (!t || t.length > 2048 || hasUnsafeUrlChars$1(t)) return null;
+	if (/%0d|%0a|%09|%0b|%0c|%20/i.test(t)) return null;
+	try {
+		const u = new URL(t);
+		if (u.protocol !== "https:") return null;
+		if (u.username || u.password) return null;
+		const host = u.hostname.toLowerCase();
+		if (host === "localhost" || host.endsWith(".localhost")) return null;
+		if (host === "127.0.0.1" || host === "::1" || host.endsWith(".local")) return null;
+		return u;
+	} catch {
+		return null;
+	}
+}
+function isHostname(s) {
+	const t = s.trim().toLowerCase();
+	if (!t || t.length > 253) return false;
+	if (t === "localhost" || t.endsWith(".localhost")) return false;
+	return HOSTNAME.test(t);
+}
+function parseHostnameAllowlist(text) {
+	const lines = text.split(/\r?\n/).map((l) => l.trim().toLowerCase()).filter(Boolean);
+	const out = [];
+	for (const line of lines) {
+		if (!isHostname(line)) throw new Error(`Invalid script host allowlist entry "${line}". Use hostnames like cdn.example.com.`);
+		if (!out.includes(line)) out.push(line);
+		if (out.length > 50) throw new Error("Script host allowlist is too long (max 50).");
+	}
+	return out;
+}
+function isSafeHttpsScriptUrl(raw) {
+	const u = parseStrictHttpsUrl(raw);
+	if (!u) return false;
+	if (u.hash) return false;
+	return true;
+}
+function isScriptHostAllowed(raw, opts) {
+	const u = parseStrictHttpsUrl(raw);
+	if (!u) return false;
+	const host = u.hostname.toLowerCase();
+	if (opts.allowPresets && PRESET_SCRIPT_HOSTS.has(host)) return true;
+	if (opts.allowlist.length === 0) return true;
+	return opts.allowlist.includes(host);
+}
+/** Optional SRI: `https://cdn.example/a.js sha384-...` or `... integrity=sha384-...`. */
+function parseScriptUrlWithIntegrity(line) {
+	const t = line.trim();
+	if (!t) return {
+		src: "",
+		integrity: null
+	};
+	const integrityEq = /\sintegrity=(sha(?:256|384|512)-[A-Za-z0-9+/=]+)$/i.exec(t);
+	if (integrityEq) return {
+		src: t.slice(0, integrityEq.index).trim(),
+		integrity: integrityEq[1] ?? null
+	};
+	const spaced = /^(https:\/\/\S+)\s+(sha(?:256|384|512)-[A-Za-z0-9+/=]+)$/i.exec(t);
+	if (spaced) return {
+		src: spaced[1] ?? "",
+		integrity: spaced[2] ?? null
+	};
+	return {
+		src: t,
+		integrity: null
+	};
+}
+function isValidIntegrity(s) {
+	if (!s) return true;
+	return /^sha(?:256|384|512)-[A-Za-z0-9+/=]+$/.test(s);
+}
+/**
+* Same-origin guard for public state-changing plugin routes.
+* Requires Origin matching the site, or Sec-Fetch-Site: same-origin.
+*/
+function assertSameOriginMutation(request, expectedOrigin) {
+	const origin = request.headers.get("origin");
+	if (origin) {
+		if (origin !== expectedOrigin) return new Response("forbidden", { status: 403 });
+		return null;
+	}
+	if ((request.headers.get("sec-fetch-site") ?? "").toLowerCase() === "same-origin") return null;
+	return new Response("forbidden", { status: 403 });
+}
+/** Coarse hour bucket for rate limiting (UTC). */
+function rateHourKey(now = /* @__PURE__ */ new Date()) {
+	return `${now.getUTCFullYear()}${String(now.getUTCMonth() + 1).padStart(2, "0")}${String(now.getUTCDate()).padStart(2, "0")}${String(now.getUTCHours()).padStart(2, "0")}`;
+}
+//#endregion
+//#region src/theme.ts
+/** Hex colors only — rejects CSS injection via theme fields. */
+const HEX = /^#(?:[0-9A-Fa-f]{3}|[0-9A-Fa-f]{6}|[0-9A-Fa-f]{8})$/;
+const DEFAULT_THEME = {
+	bg: "#111111",
+	text: "#eeeeee",
+	accent: "#3b82f6",
+	radiusPx: 6
+};
+function isSafeHexColor(s) {
+	return HEX.test(s.trim());
+}
+function normalizeHexColor(s, fallback) {
+	const t = s.trim();
+	return isSafeHexColor(t) ? t : fallback;
+}
+function normalizeRadiusPx(n, fallback) {
+	if (typeof n !== "number" || !Number.isFinite(n)) return fallback;
+	return Math.min(24, Math.max(0, Math.round(n)));
+}
+function parseRadiusInput(s, fallback) {
+	const t = s.trim();
+	if (!t) return fallback;
+	if (!/^\d{1,2}$/.test(t)) throw new Error("Corner radius must be a whole number from 0 to 24.");
+	const n = Number(t);
+	if (n > 24) throw new Error("Corner radius must be a whole number from 0 to 24.");
+	return normalizeRadiusPx(n, fallback);
+}
+//#endregion
 //#region src/config.ts
 /**
 * EmPrivacy KV document (`consent:config`) and shared helpers.
@@ -10,18 +411,40 @@ const COOKIE_NAME = "emprivacy_cc";
 const PLUGIN_ID = "emprivacy";
 const DEFAULT_CONFIG = {
 	bannerTitle: "Cookies & privacy",
-	bannerMessage: "We use cookies to run this site and optionally for analytics and marketing. You can accept or customize your choices.",
+	bannerMessage: "We use cookies to run this site and optionally for functional embeds, analytics, and marketing. You can accept or customize your choices.",
 	privacyPolicyUrl: "/privacy",
 	cookiePolicyUrl: "",
 	strictDefaults: true,
 	policyVersion: "1",
 	cloudflareWebAnalyticsToken: "",
 	analyticsProvider: "cloudflare",
+	analyticsId: "",
+	umamiScriptUrl: "",
 	analyticsScriptUrls: [],
 	marketingScriptUrls: [],
+	scriptIntegrity: {},
+	scriptHostAllowlist: [],
+	cookieMaxAgeDays: 180,
 	googleConsentMode: false,
-	logConsentToServer: false
+	logConsentToServer: false,
+	embedCategory: "marketing",
+	gateEmbeds: true,
+	hideBannerOnPolicyPages: true,
+	defaultLocale: "en",
+	localeOverrides: {},
+	theme: { ...DEFAULT_THEME }
 };
+const ANALYTICS_PROVIDERS = [
+	"cloudflare",
+	"none",
+	"custom",
+	"plausible",
+	"fathom",
+	"umami",
+	"simpleanalytics",
+	"ga4",
+	"gtm"
+];
 function hasUnsafeUrlChars(s) {
 	return /[\u0000-\u001F\u007F\s]/.test(s);
 }
@@ -40,11 +463,14 @@ function isHttpsUrl(s) {
 	}
 }
 function invalidScriptUrlError(kind, u) {
-	if (u.includes("<") || u.includes(">")) return `Invalid ${kind} script URL (https only). Paste one full https:// URL per line (the script src only), not a <script> tag or HTML comment. Example: https://static.cloudflareinsights.com/beacon.min.js. The invalid line was: ${u}`;
+	if (u.includes("<") || u.includes(">")) return `Invalid ${kind} script URL (https only). Paste one full https:// URL per line (the script src only), not a <script> tag or HTML comment. The invalid line was: ${u}`;
 	return `Invalid ${kind} script URL (https only): ${u}`;
 }
 function isAnalyticsProvider(s) {
-	return s === "cloudflare" || s === "none" || s === "custom";
+	return ANALYTICS_PROVIDERS.includes(s);
+}
+function isEmbedCategory(s) {
+	return s === "functional" || s === "marketing";
 }
 /** Reject characters that would break JSON or attributes; allow typical Cloudflare site token strings. */
 function assertValidCloudflareToken(t) {
@@ -89,8 +515,34 @@ function assertLength(label, s, min, max) {
 function assertOptionalLength(label, s, max) {
 	if (s.trim().length > max) throw new Error(`${label} is too long.`);
 }
+function pathnameFromHref(href) {
+	const t = href.trim();
+	if (!t) return null;
+	if (isRootRelativeSitePath(t)) return t.split(/[?#]/)[0] ?? t;
+	try {
+		return new URL(t).pathname.replace(/\/+$/, "") || "/";
+	} catch {
+		return null;
+	}
+}
+/** True when the public page is the configured privacy or cookie policy. */
+function isPolicyPagePath(pagePath, cfg) {
+	const raw = pagePath.trim();
+	if (!raw) return false;
+	const current = raw.split(/[?#]/)[0]?.replace(/\/+$/, "") || "/";
+	for (const stored of [cfg.privacyPolicyUrl, cfg.cookiePolicyUrl]) {
+		const pn = pathnameFromHref(stored);
+		if (!pn) continue;
+		if (current === pn) return true;
+		if (current.endsWith(pn) && pn !== "/") return true;
+	}
+	return false;
+}
 function normalizeConfig(raw) {
-	if (typeof raw !== "object" || raw === null) return { ...DEFAULT_CONFIG };
+	if (typeof raw !== "object" || raw === null) return {
+		...DEFAULT_CONFIG,
+		theme: { ...DEFAULT_THEME }
+	};
 	const o = raw;
 	const analytics = Array.isArray(o.analyticsScriptUrls) ? o.analyticsScriptUrls.filter((x) => typeof x === "string") : DEFAULT_CONFIG.analyticsScriptUrls;
 	const marketing = Array.isArray(o.marketingScriptUrls) ? o.marketingScriptUrls.filter((x) => typeof x === "string") : DEFAULT_CONFIG.marketingScriptUrls;
@@ -100,6 +552,15 @@ function normalizeConfig(raw) {
 	if (isAnalyticsProvider(apCandidate)) analyticsProvider = apCandidate;
 	else if (analytics.length > 0) analyticsProvider = "custom";
 	else analyticsProvider = DEFAULT_CONFIG.analyticsProvider;
+	const themeRaw = o.theme && typeof o.theme === "object" ? o.theme : {};
+	const embedRaw = typeof o.embedCategory === "string" ? o.embedCategory.trim() : "";
+	const integrityRaw = o.scriptIntegrity && typeof o.scriptIntegrity === "object" && !Array.isArray(o.scriptIntegrity) ? o.scriptIntegrity : {};
+	const scriptIntegrity = {};
+	for (const [k, v] of Object.entries(integrityRaw)) {
+		if (typeof k === "string" && typeof v === "string" && isValidIntegrity(v) && isSafeHttpsScriptUrl(k)) scriptIntegrity[k] = v;
+		if (Object.keys(scriptIntegrity).length >= 100) break;
+	}
+	const scriptHostAllowlist = (Array.isArray(o.scriptHostAllowlist) ? o.scriptHostAllowlist.filter((x) => typeof x === "string") : []).map((h) => h.trim().toLowerCase()).filter((h) => isHostname$1(h)).slice(0, 50);
 	return {
 		bannerTitle: typeof o.bannerTitle === "string" ? o.bannerTitle : DEFAULT_CONFIG.bannerTitle,
 		bannerMessage: typeof o.bannerMessage === "string" ? o.bannerMessage : DEFAULT_CONFIG.bannerMessage,
@@ -109,12 +570,53 @@ function normalizeConfig(raw) {
 		policyVersion: typeof o.policyVersion === "string" && o.policyVersion.length > 0 ? o.policyVersion : DEFAULT_CONFIG.policyVersion,
 		cloudflareWebAnalyticsToken: cfTok,
 		analyticsProvider,
+		analyticsId: typeof o.analyticsId === "string" ? o.analyticsId : "",
+		umamiScriptUrl: typeof o.umamiScriptUrl === "string" ? o.umamiScriptUrl : "",
 		analyticsScriptUrls: analytics,
 		marketingScriptUrls: marketing,
+		scriptIntegrity,
+		scriptHostAllowlist,
+		cookieMaxAgeDays: normalizeCookieMaxAgeDays(o.cookieMaxAgeDays, DEFAULT_CONFIG.cookieMaxAgeDays),
 		googleConsentMode: typeof o.googleConsentMode === "boolean" ? o.googleConsentMode : DEFAULT_CONFIG.googleConsentMode,
-		logConsentToServer: typeof o.logConsentToServer === "boolean" ? o.logConsentToServer : DEFAULT_CONFIG.logConsentToServer
+		logConsentToServer: typeof o.logConsentToServer === "boolean" ? o.logConsentToServer : DEFAULT_CONFIG.logConsentToServer,
+		embedCategory: isEmbedCategory(embedRaw) ? embedRaw : DEFAULT_CONFIG.embedCategory,
+		gateEmbeds: typeof o.gateEmbeds === "boolean" ? o.gateEmbeds : DEFAULT_CONFIG.gateEmbeds,
+		hideBannerOnPolicyPages: typeof o.hideBannerOnPolicyPages === "boolean" ? o.hideBannerOnPolicyPages : DEFAULT_CONFIG.hideBannerOnPolicyPages,
+		defaultLocale: typeof o.defaultLocale === "string" && o.defaultLocale ? o.defaultLocale : DEFAULT_CONFIG.defaultLocale,
+		localeOverrides: parseLocaleOverrides(o.localeOverrides),
+		theme: {
+			bg: normalizeHexColor(typeof themeRaw.bg === "string" ? themeRaw.bg : "", DEFAULT_THEME.bg),
+			text: normalizeHexColor(typeof themeRaw.text === "string" ? themeRaw.text : "", DEFAULT_THEME.text),
+			accent: normalizeHexColor(typeof themeRaw.accent === "string" ? themeRaw.accent : "", DEFAULT_THEME.accent),
+			radiusPx: normalizeRadiusPx(themeRaw.radiusPx, DEFAULT_THEME.radiusPx)
+		}
 	};
 }
+function assertAnalyticsId(provider, id, umamiScriptUrl) {
+	const t = id.trim();
+	if (provider === "plausible") {
+		if (!isHostname$1(t)) throw new Error("Plausible domain must be a hostname like example.com (no https://).");
+		return;
+	}
+	if (provider === "fathom") {
+		if (!isFathomId(t)) throw new Error("Fathom site ID must be 4–32 letters or digits.");
+		return;
+	}
+	if (provider === "umami") {
+		if (!isUmamiId(t)) throw new Error("Umami website ID looks invalid.");
+		if (!isHttpsUrl(umamiScriptUrl)) throw new Error("Umami requires the https script URL (Cloud or your self-hosted tracker).");
+		return;
+	}
+	if (provider === "ga4") {
+		if (!isGa4Id(t)) throw new Error("GA4 measurement ID must look like G-XXXXXXXX.");
+		return;
+	}
+	if (provider === "gtm") {
+		if (!isGtmId(t)) throw new Error("Google Tag Manager ID must look like GTM-XXXX.");
+		return;
+	}
+	if (provider === "simpleanalytics" && t && !isHostname$1(t)) throw new Error("Simple Analytics hostname must be a domain like example.com, or empty.");
+}
 /** Validate admin-submitted fields; throws an Error with a short message on failure */
 function assertValidSavedConfig(input) {
 	assertLength("Policy version", input.policyVersion, 1, 64);
@@ -128,27 +630,60 @@ function assertValidSavedConfig(input) {
 	if (cookiePolicyUrl.length > 2048) throw new Error("Cookie policy URL/path is too long.");
 	if (!cookiePolicyUrl) cookiePolicyUrl = DEFAULT_CONFIG.cookiePolicyUrl;
 	const ap = input.analyticsPlatform.trim() || "cloudflare";
-	if (!isAnalyticsProvider(ap)) throw new Error("Analytics: choose a supported option (Cloudflare, None, or Custom).");
+	if (!isAnalyticsProvider(ap)) throw new Error("Analytics: choose a supported platform.");
 	const tokenTrim = input.cloudflareToken.trim();
 	if (ap === "cloudflare") assertValidCloudflareToken(tokenTrim);
+	const umamiScriptUrl = input.umamiScriptUrl.trim();
+	if (ap === "umami" && umamiScriptUrl && !isHttpsUrl(umamiScriptUrl)) throw new Error(invalidScriptUrlError("umami", umamiScriptUrl));
+	if (ap !== "none" && ap !== "custom" && ap !== "cloudflare" && ap !== "simpleanalytics" && ap !== "gtm") assertAnalyticsId(ap, input.analyticsId, umamiScriptUrl);
+	else if (ap === "simpleanalytics" && input.analyticsId.trim()) assertAnalyticsId(ap, input.analyticsId, umamiScriptUrl);
+	else if (ap === "gtm") assertAnalyticsId(ap, input.analyticsId, umamiScriptUrl);
+	const scriptHostAllowlist = parseHostnameAllowlist(input.scriptHostAllowlistText);
+	const cookieMaxAgeDays = parseCookieMaxAgeDays(input.cookieMaxAgeDays, 180);
+	const scriptIntegrity = {};
+	const assertScriptLine = (kind, line) => {
+		const { src, integrity } = parseScriptUrlWithIntegrity(line);
+		if (!src || src.length > 2048) throw new Error(invalidScriptUrlError(kind, line));
+		if (!isSafeHttpsScriptUrl(src)) throw new Error(invalidScriptUrlError(kind, src));
+		if (integrity && !isValidIntegrity(integrity)) throw new Error(`Invalid SRI for ${kind} script (expected sha256-|sha384-|sha512-…).`);
+		if (!isScriptHostAllowed(src, {
+			allowlist: scriptHostAllowlist,
+			allowPresets: false
+		})) throw new Error(`${kind} script host is not on the allowlist. Add the hostname or clear the allowlist.`);
+		if (integrity) scriptIntegrity[src] = integrity;
+		return src;
+	};
+	if (ap === "umami" && umamiScriptUrl) {
+		if (!isScriptHostAllowed(umamiScriptUrl, {
+			allowlist: scriptHostAllowlist,
+			allowPresets: false
+		})) throw new Error("Umami script host is not on the allowlist. Add the hostname or clear the allowlist.");
+	}
 	const analyticsScriptUrls = [];
 	if (ap === "custom") {
 		const list = parseUrlList(input.analyticsUrlsText);
 		if (list.length > 50) throw new Error("Analytics script URL list is too long (max 50).");
-		for (const u of list) {
-			if (u.length > 2048) throw new Error(invalidScriptUrlError("analytics", u));
-			if (!isHttpsUrl(u)) throw new Error(invalidScriptUrlError("analytics", u));
-			analyticsScriptUrls.push(u);
-		}
+		for (const u of list) analyticsScriptUrls.push(assertScriptLine("analytics", u));
 	}
 	const marketingScriptUrls = [];
 	const mlist = parseUrlList(input.marketingUrlsText);
 	if (mlist.length > 50) throw new Error("Marketing script URL list is too long (max 50).");
-	for (const u of mlist) {
-		if (u.length > 2048) throw new Error(invalidScriptUrlError("marketing", u));
-		if (!isHttpsUrl(u)) throw new Error(invalidScriptUrlError("marketing", u));
-		marketingScriptUrls.push(u);
+	for (const u of mlist) marketingScriptUrls.push(assertScriptLine("marketing", u));
+	const embedCategory = input.embedCategory.trim() || "marketing";
+	if (!isEmbedCategory(embedCategory)) throw new Error("Embeds must require Functional or Marketing consent.");
+	const defaultLocale = input.defaultLocale.trim().toLowerCase() || "en";
+	if (!/^[a-z]{2,3}(?:-[a-z]{2})?$/.test(defaultLocale)) throw new Error("Default locale must look like en or pt-BR.");
+	const localeOverrides = parseLocaleOverridesText(input.localeOverridesText);
+	for (const pack of Object.values(localeOverrides)) {
+		if (pack.bannerTitle !== void 0) assertOptionalLength("Translated banner title", pack.bannerTitle, 120);
+		if (pack.bannerMessage !== void 0) assertOptionalLength("Translated short notice", pack.bannerMessage, 600);
 	}
+	const themeBg = input.themeBg.trim() || DEFAULT_THEME.bg;
+	const themeText = input.themeText.trim() || DEFAULT_THEME.text;
+	const themeAccent = input.themeAccent.trim() || DEFAULT_THEME.accent;
+	if (input.themeBg.trim() && !/^#(?:[0-9A-Fa-f]{3}|[0-9A-Fa-f]{6}|[0-9A-Fa-f]{8})$/.test(themeBg)) throw new Error("Banner background must be a hex color like #111111.");
+	if (input.themeText.trim() && !/^#(?:[0-9A-Fa-f]{3}|[0-9A-Fa-f]{6}|[0-9A-Fa-f]{8})$/.test(themeText)) throw new Error("Banner text color must be a hex color like #eeeeee.");
+	if (input.themeAccent.trim() && !/^#(?:[0-9A-Fa-f]{3}|[0-9A-Fa-f]{6}|[0-9A-Fa-f]{8})$/.test(themeAccent)) throw new Error("Banner accent color must be a hex color like #3b82f6.");
 	return normalizeConfig({
 		bannerTitle: input.bannerTitle.trim() || DEFAULT_CONFIG.bannerTitle,
 		bannerMessage: input.bannerMessage.trim() || DEFAULT_CONFIG.bannerMessage,
@@ -158,73 +693,156 @@ function assertValidSavedConfig(input) {
 		policyVersion: input.policyVersion.trim(),
 		analyticsProvider: ap,
 		cloudflareWebAnalyticsToken: ap === "cloudflare" ? tokenTrim : "",
+		analyticsId: ap === "cloudflare" || ap === "custom" || ap === "none" ? "" : input.analyticsId.trim(),
+		umamiScriptUrl: ap === "umami" ? umamiScriptUrl : "",
 		analyticsScriptUrls: ap === "custom" ? analyticsScriptUrls : [],
 		marketingScriptUrls,
+		scriptIntegrity,
+		scriptHostAllowlist,
+		cookieMaxAgeDays,
 		googleConsentMode: input.googleConsentMode,
-		logConsentToServer: input.logConsentToServer
+		logConsentToServer: input.logConsentToServer,
+		embedCategory,
+		gateEmbeds: input.gateEmbeds,
+		hideBannerOnPolicyPages: input.hideBannerOnPolicyPages,
+		defaultLocale,
+		localeOverrides,
+		theme: {
+			bg: themeBg,
+			text: themeText,
+			accent: themeAccent,
+			radiusPx: parseRadiusInput(input.themeRadius, DEFAULT_THEME.radiusPx)
+		}
 	});
 }
-
-//#endregion
-//#region src/version.ts
-const VERSION = "2.0.0";
-
+/** Safe to embed in `<script type="application/json">` (breakout-safe) */
+function jsonForHtmlScript(value) {
+	return JSON.stringify(value).replace(/[<>&\u2028\u2029]/g, (c) => {
+		switch (c) {
+			case "<": return "\\u003c";
+			case ">": return "\\u003e";
+			case "&": return "\\u0026";
+			case "\u2028": return "\\u2028";
+			case "\u2029": return "\\u2029";
+			default: return c;
+		}
+	});
+}
+function resolvePublicCopy(cfg, locale) {
+	const copy = resolveBannerCopy({
+		bannerTitle: cfg.bannerTitle,
+		bannerMessage: cfg.bannerMessage
+	}, cfg.localeOverrides, locale ?? cfg.defaultLocale);
+	return {
+		bannerTitle: copy.bannerTitle,
+		bannerMessage: copy.bannerMessage,
+		ui: chromeForLocale(locale ?? cfg.defaultLocale)
+	};
+}
 //#endregion
-//#region src/runtime.ts
-const ADMIN_SETTINGS_PATH = "/settings";
-const SAVE_ACTION_ID = "emprivacy-save";
-const recordInput = z.object({
-	policyVersion: z.string().trim().min(1).max(64),
-	analytics: z.boolean(),
-	marketing: z.boolean()
-});
-async function loadConfig(ctx) {
-	const raw = await ctx.kv.get(KV_KEY);
-	if (!raw) return normalizeConfig({});
-	try {
-		return normalizeConfig(JSON.parse(raw));
-	} catch {
-		return normalizeConfig({});
-	}
+//#region src/npm-version.ts
+/** Public npm package page for this plugin. */
+const NPM_PACKAGE_URL = "https://www.npmjs.com/package/@emplugins/emprivacy";
+/** npm registry metadata for the `latest` dist-tag. */
+const NPM_REGISTRY_LATEST_URL = "https://registry.npmjs.org/@emplugins/emprivacy/latest";
+const SEMVER = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+const SUCCESS_CACHE_MS = 6e5;
+const FAILURE_CACHE_MS = 6e4;
+const FETCH_TIMEOUT_MS = 2500;
+let cache = null;
+/** Accept only a well-formed semver from untrusted registry JSON. */
+function parseNpmLatestVersion(data) {
+	if (!data || typeof data !== "object") return null;
+	const version = data.version;
+	if (typeof version !== "string") return null;
+	const trimmed = version.trim();
+	return SEMVER.test(trimmed) ? trimmed : null;
 }
-async function saveConfigString(ctx, json) {
-	await ctx.kv.set(KV_KEY, json);
+function parseCore(version) {
+	const m = /^(\d+)\.(\d+)\.(\d+)/.exec(version);
+	if (!m) return null;
+	return [
+		Number(m[1]),
+		Number(m[2]),
+		Number(m[3])
+	];
 }
-/** Path-only record URL for browser fetch (same origin). */
-function recordPathForSite() {
-	return `/_emdash/api/plugins/${PLUGIN_ID}/record`;
+/** True when `latest` is a higher MAJOR.MINOR.PATCH than `installed`. */
+function isNewerPublished(latest, installed) {
+	const a = parseCore(latest);
+	const b = parseCore(installed);
+	if (!a || !b) return latest !== installed;
+	if (a[0] !== b[0]) return a[0] > b[0];
+	if (a[1] !== b[1]) return a[1] > b[1];
+	return a[2] > b[2];
 }
-/** Absolute URL for metadata / banner; paths resolved via EmDash `ctx.url()`. */
-function absolutePolicyHref(stored, ctx) {
-	const r = resolvePolicyHref(stored, ctx).trim();
-	if (!r) return null;
+function pluginVersionFields(installed, latest) {
+	return [{
+		label: "Installed version",
+		value: installed
+	}, {
+		label: "Latest on npm",
+		value: latest ?? "Could not reach npm"
+	}];
+}
+function pluginVersionNote(installed, latest) {
+	if (latest && isNewerPublished(latest, installed)) return `A newer version is published. Update @emplugins/emprivacy to get it. ${NPM_PACKAGE_URL}`;
+	return `Published package: ${NPM_PACKAGE_URL}`;
+}
+/**
+* Read the published `latest` version from the npm registry.
+* Results are cached briefly so admin save/reload does not hit npm every time.
+* Failures return null and never throw — the settings page must still load.
+*/
+async function fetchLatestPublishedVersion(options) {
+	const now = options?.now ?? Date.now();
+	if (cache && now < cache.expiresAt) return cache.value;
+	const doFetch = options?.fetch ?? globalThis.fetch;
+	const timeoutMs = options?.timeoutMs ?? FETCH_TIMEOUT_MS;
 	try {
-		if (new URL(r).protocol !== "https:") return null;
-		return r;
+		const response = await doFetch(NPM_REGISTRY_LATEST_URL, {
+			method: "GET",
+			headers: {
+				Accept: "application/json",
+				"User-Agent": "EmPrivacy (https://github.com/EmPlugins/EmPrivacy)"
+			},
+			signal: AbortSignal.timeout(timeoutMs)
+		});
+		if (!response.ok) {
+			cache = {
+				value: null,
+				expiresAt: now + FAILURE_CACHE_MS
+			};
+			return null;
+		}
+		const version = parseNpmLatestVersion(await response.json());
+		cache = {
+			value: version,
+			expiresAt: now + (version ? SUCCESS_CACHE_MS : FAILURE_CACHE_MS)
+		};
+		return version;
 	} catch {
+		cache = {
+			value: null,
+			expiresAt: now + FAILURE_CACHE_MS
+		};
 		return null;
 	}
 }
-function buildGoogleConsentHeadScript() {
-	return `(function(){window.dataLayer=window.dataLayer||[];function g(){window.dataLayer.push(arguments);}window.gtag=g;g("consent","default",{"analytics_storage":"denied","ad_storage":"denied","ad_user_data":"denied","ad_personalization":"denied","functionality_storage":"granted","security_storage":"granted","personalization_storage":"denied"});})();`;
-}
+//#endregion
+//#region src/public-bootstrap.ts
 /**
-* Public-site bootstrap: no HTML from admin strings in DOM APIs beyond JSON.parse —
-* banner copy is applied with textContent / createTextNode.
+* Public-site bootstrap. Banner copy is applied with textContent / createTextNode only.
+* Embed/script URLs are re-validated in the browser (never trust DOM data-src alone).
 */
 function buildBodyBootstrap(pr) {
 	return `(function(){
-var C=${JSON.stringify(pr).replace(/[<>&\u2028\u2029]/g, (c) => {
-		switch (c) {
-			case "<": return "\\u003c";
-			case ">": return "\\u003e";
-			case "&": return "\\u0026";
-			case "\u2028": return "\\u2028";
-			case "\u2029": return "\\u2029";
-			default: return c;
-		}
-	})};
+var C=${jsonForHtmlScript(pr)};
 var CN="${COOKIE_NAME}";
+var listeners=[];
+var PRESET_HOSTS={"static.cloudflareinsights.com":1,"plausible.io":1,"cdn.usefathom.com":1,"scripts.simpleanalyticscdn.com":1,"www.googletagmanager.com":1,"googletagmanager.com":1};
+var YT_IFRAME=/^https:\\/\\/(?:www\\.)?youtube-nocookie\\.com\\/embed\\/[A-Za-z0-9_-]{11}\\/?$/;
+var VIMEO_IFRAME=/^https:\\/\\/player\\.vimeo\\.com\\/video\\/\\d{6,12}\\/?$/;
 function readCookie(){
 try{
 var m=document.cookie.match(new RegExp("(?:^|;\\\\s*)"+CN+"=([^;]*)"));
@@ -235,44 +853,96 @@ return v;
 }
 function writeCookie(val){
 var secure=document.location.protocol==="https:"?"; Secure":"";
-document.cookie=CN+"="+encodeURIComponent(val)+"; Path=/; SameSite=Lax"+secure+"; Max-Age=31536000";
+var maxAge=typeof C.cookieMaxAge==="number"&&C.cookieMaxAge>0?C.cookieMaxAge:15552000;
+document.cookie=CN+"="+encodeURIComponent(val)+"; Path=/; SameSite=Lax"+secure+"; Max-Age="+maxAge;
 }
+function flagOk(x){return x===0||x===1||x===true||x===false;}
 function parseState(s){
 try{
 var o=JSON.parse(s);
 if(!o||typeof o!=="object")return null;
 if(typeof o.v!=="string")return null;
 if(o.v!==C.policyVersion)return null;
-var a=o.a,m=o.m;
-var aOk=(a===0||a===1||a===true||a===false);
-var mOk=(m===0||m===1||m===true||m===false);
-if(!aOk||!mOk)return null;
-return {v:o.v,a:!!a,m:!!m};
+if(!flagOk(o.a)||!flagOk(o.m)||!flagOk(o.f))return null;
+return {v:o.v,essential:true,functional:!!o.f,analytics:!!o.a,marketing:!!o.m};
 }catch(e){return null;}
 }
+function currentState(){return parseState(readCookie());}
+function emit(st){
+listeners.slice().forEach(function(fn){try{fn(st);}catch(e){}});
+try{document.dispatchEvent(new CustomEvent("emprivacy:change",{detail:st}));}catch(e){}
+}
 function needBanner(){
-var c=parseState(readCookie());
-if(!c)return true;
-return false;
+if(C.hideBanner)return false;
+return !parseState(readCookie());
 }
-function alreadyScriptSrc(u){
+function parseHttps(raw){
 try{
-return Array.prototype.some.call(document.getElementsByTagName("script"),function(s){
-return s.src===u;
-});
-}catch(e){
-return false;
+if(!raw||typeof raw!=="string"||raw.length>2048)return null;
+if(/[\\u0000-\\u001F\\u007F\\s]/.test(raw))return null;
+if(/%0d|%0a|%09|%0b|%0c|%20/i.test(raw))return null;
+var u=new URL(raw);
+if(u.protocol!=="https:")return null;
+if(u.username||u.password)return null;
+var h=u.hostname.toLowerCase();
+if(h==="localhost"||h.endsWith(".localhost")||h==="127.0.0.1"||h==="::1")return null;
+return u;
+}catch(e){return null;}
 }
+function hostAllowed(u,allowPresets){
+var h=u.hostname.toLowerCase();
+if(allowPresets&&PRESET_HOSTS[h])return true;
+var list=C.scriptHostAllowlist||[];
+if(!list.length)return true;
+return list.indexOf(h)>=0;
 }
-function loadScript(src){
-if(alreadyScriptSrc(src))return;
+function safeScriptUrl(raw,allowPresets){
+var u=parseHttps(raw);
+if(!u||u.hash)return null;
+if(!hostAllowed(u,!!allowPresets))return null;
+return u.href;
+}
+function allowedIframe(src){return YT_IFRAME.test(src)||VIMEO_IFRAME.test(src);}
+function allowedLink(src,kind){
+var u=parseHttps(src);
+if(!u)return false;
+var h=u.hostname.toLowerCase();
+if(h==="x.com"||h==="www.x.com"||h==="twitter.com"||h==="www.twitter.com"||h==="mobile.twitter.com"){
+return /\\/(?:i\\/web\\/)?status(?:es)?\\/\\d{5,20}\\/?$/i.test(u.pathname);
+}
+if(h==="bsky.app"||h==="www.bsky.app"){
+return /^\\/profile\\/[^/]+\\/post\\/[^/]+\\/?$/.test(u.pathname);
+}
+if(h==="gist.github.com"){
+return /^\\/[A-Za-z0-9-]{1,39}\\/[a-f0-9]{8,64}\\/?$/i.test(u.pathname);
+}
+if(/^\\/@[^/]+\\/\\d+\\/?$/.test(u.pathname)||/^\\/users\\/[^/]+\\/statuses\\/\\d+\\/?$/.test(u.pathname))return true;
+return kind==="linkPreview";
+}
+function alreadyScriptSrc(u){
+try{
+return Array.prototype.some.call(document.getElementsByTagName("script"),function(s){return s.src===u;});
+}catch(e){return false;}
+}
+function loadScript(src, attrs, integrity, allowPresets){
+var safe=safeScriptUrl(src,allowPresets);
+if(!safe||alreadyScriptSrc(safe))return;
 var e=document.createElement("script");
-e.src=src;e.async=true;e.referrerPolicy="no-referrer-when-downgrade";
+e.src=safe;e.async=true;e.referrerPolicy="no-referrer-when-downgrade";
+if(integrity&&/^sha(?:256|384|512)-[A-Za-z0-9+/=]+$/.test(integrity)){
+e.integrity=integrity;
+e.crossOrigin="anonymous";
+}
+if(attrs){
+Object.keys(attrs).forEach(function(k){
+if(/^[a-zA-Z][a-zA-Z0-9_-]*$/.test(k)) e.setAttribute(k,String(attrs[k]));
+});
+}
 document.head.appendChild(e);
 }
 function loadCloudflareBeacon(token){
 var u="https://static.cloudflareinsights.com/beacon.min.js";
-if(!token)return;
+if(!token||typeof token!=="string"||token.length>256||/[\\s<>'"&]/.test(token))return;
 if(alreadyScriptSrc(u))return;
 var e=document.createElement("script");
 e.src=u;
@@ -281,72 +951,121 @@ e.setAttribute("data-cf-beacon",JSON.stringify({token:token}));
 e.referrerPolicy="no-referrer-when-downgrade";
 document.head.appendChild(e);
 }
-function applyScripts(a,m){
-if(a){
-if(C.analyticsProvider==="cloudflare"){
-loadCloudflareBeacon(C.cloudflareToken);
-}else if(C.analyticsProvider==="custom"){
-C.analyticsScriptUrls.forEach(loadScript);
+function applyAnalytics(){
+var L=C.loader||{type:"none"};
+if(L.type==="cloudflare") loadCloudflareBeacon(L.token);
+else if(L.type==="custom") (L.scripts||[]).forEach(function(s){loadScript(s.src,null,s.integrity,false);});
+else if(L.type==="plausible") loadScript(L.src,{"data-domain":L.domain},null,true);
+else if(L.type==="fathom") loadScript(L.src,{"data-site":L.siteId},null,true);
+else if(L.type==="umami") loadScript(L.src,{"data-website-id":L.websiteId},null,false);
+else if(L.type==="simpleanalytics") loadScript(L.src,null,null,true);
+else if(L.type==="ga4"){
+window.dataLayer=window.dataLayer||[];
+if(typeof window.gtag!=="function"){window.gtag=function(){window.dataLayer.push(arguments);};}
+loadScript("https://www.googletagmanager.com/gtag/js?id="+encodeURIComponent(L.measurementId),null,null,true);
+window.gtag("js",new Date());
+window.gtag("config",L.measurementId);
 }
 }
-if(m)C.marketingScriptUrls.forEach(loadScript);
+function applyMarketing(){
+var urls=C.marketingScripts||[];
+urls.forEach(function(s){loadScript(s.src,null,s.integrity,false);});
+var L=C.loader||{type:"none"};
+if(L.type==="gtm"){
+window.dataLayer=window.dataLayer||[];
+window.dataLayer.push({"gtm.start":Date.now(),event:"gtm.js"});
+loadScript("https://www.googletagmanager.com/gtm.js?id="+encodeURIComponent(L.containerId),null,null,true);
 }
-function gtagUpdate(a,m){
+}
+function applyScripts(st){
+if(st.analytics) applyAnalytics();
+if(st.marketing) applyMarketing();
+}
+function gtagUpdate(st){
 if(!C.googleConsentMode||!window.gtag)return;
 window.gtag("consent","update",{
-analytics_storage:a?"granted":"denied",
-ad_storage:m?"granted":"denied",
-ad_user_data:m?"granted":"denied",
-ad_personalization:m?"granted":"denied",
-personalization_storage:m?"granted":"denied"
+analytics_storage:st.analytics?"granted":"denied",
+ad_storage:st.marketing?"granted":"denied",
+ad_user_data:st.marketing?"granted":"denied",
+ad_personalization:st.marketing?"granted":"denied",
+personalization_storage:st.marketing?"granted":"denied",
+functionality_storage:st.functional?"granted":"denied",
+security_storage:"granted"
 });
 }
-function logServer(a,m){
+function logServer(st){
 if(!C.logConsent)return;
-var p=C.recordPath;
-fetch(p,{
+fetch(C.recordPath,{
 method:"POST",
 credentials:"same-origin",
 headers:{"Content-Type":"application/json"},
-body:JSON.stringify({policyVersion:C.policyVersion,analytics:!!a,marketing:!!m})
+body:JSON.stringify({policyVersion:C.policyVersion,functional:!!st.functional,analytics:!!st.analytics,marketing:!!st.marketing})
 }).catch(function(){});
 }
 function hide(el){if(el)el.setAttribute("hidden","");el&&(el.style.display="none");}
 function show(el){if(el)el.removeAttribute("hidden");el&&(el.style.display="");}
-function mount(){
-var root=document.getElementById("emprivacy-root");
-if(!root)return;
-var trigger=document.createElement("button");
-trigger.type="button";
-trigger.className="emprivacy-cookie-trigger";
-trigger.setAttribute("aria-label","Cookie and privacy settings");
-var ic=document.createElement("span");
-ic.setAttribute("aria-hidden","true");
-ic.className="emprivacy-cookie-trigger-icon";
-ic.appendChild(document.createTextNode("🍪"));
-trigger.appendChild(ic);
-function showTrigger(){
-trigger.removeAttribute("hidden");
+function embedAllowed(st){
+if(!C.gateEmbeds)return false;
+return C.embedCategory==="functional"?!!st.functional:!!st.marketing;
 }
-function hideTrigger(){
-trigger.setAttribute("hidden","");
+function mountIframe(box,src){
+if(!allowedIframe(src))return;
+var f=document.createElement("iframe");
+f.src=src;
+f.setAttribute("loading","lazy");
+f.setAttribute("referrerpolicy","strict-origin-when-cross-origin");
+f.setAttribute("allow","accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share");
+f.setAttribute("allowfullscreen","");
+f.setAttribute("sandbox","allow-scripts allow-same-origin allow-presentation");
+f.setAttribute("title",box.getAttribute("data-label")||"Embed");
+f.style.width="100%";
+f.style.aspectRatio="16/9";
+f.style.border="0";
+box.replaceWith(f);
 }
-function mkRow(label,id,on){
-var w=document.createElement("label");
-w.className="emprivacy-switch";
-var cb=document.createElement("input");
-cb.type="checkbox";
-cb.id=id;
-cb.checked=on;
-w.appendChild(cb);
-w.appendChild(document.createTextNode(" "+label));
-return {wrap:w,box:cb};
+function mountLink(box,src,label,kind){
+if(!allowedLink(src,kind))return;
+var a=document.createElement("a");
+a.href=src;
+a.rel="noopener noreferrer nofollow";
+a.target="_blank";
+a.appendChild(document.createTextNode(label||src));
+box.replaceWith(a);
+}
+function hydrateEmbeds(st){
+if(!C.gateEmbeds)return;
+var nodes=document.querySelectorAll("[data-emprivacy-embed]");
+Array.prototype.forEach.call(nodes,function(box){
+var copy=box.querySelector(".emprivacy-embed-copy");
+var loadBtn=box.querySelector("[data-emprivacy-embed-load]");
+if(copy) copy.textContent=C.ui.embedBlocked;
+if(loadBtn) loadBtn.textContent=C.ui.loadEmbed;
+if(!embedAllowed(st))return;
+var src=box.getAttribute("data-src")||"";
+var mode=box.getAttribute("data-mode")||"";
+var kind=box.getAttribute("data-emprivacy-embed")||"";
+if(mode==="iframe") mountIframe(box,src);
+else mountLink(box,src,box.getAttribute("data-label")||"",kind);
+});
+}
+function persist(a,m,f,opts){
+var st={v:C.policyVersion,essential:true,functional:!!f,analytics:!!a,marketing:!!m};
+writeCookie(JSON.stringify({v:st.v,a:st.analytics?1:0,m:st.marketing?1:0,f:st.functional?1:0}));
+logServer(st);
+gtagUpdate(st);
+emit(st);
+hydrateEmbeds(st);
+if(!opts||!opts.skipReload){
+location.reload();
+return st;
+}
+applyScripts(st);
+return st;
 }
 function addPolicyLinks(links){
 function addOne(href,text){
 if(!href)return;
-var ok=href.indexOf("https://")===0;
-if(!ok)return;
+if(!parseHttps(href))return;
 var a=document.createElement("a");
 a.href=href;
 a.rel="nofollow noopener";
@@ -354,20 +1073,106 @@ a.target="_blank";
 a.appendChild(document.createTextNode(text));
 links.appendChild(a);
 }
-addOne(C.privacyPolicyUrl,"Privacy policy");
-if(C.cookiePolicyUrl)addOne(C.cookiePolicyUrl,"Cookie policy");
+addOne(C.privacyPolicyUrl,C.ui.privacyPolicy);
+if(C.cookiePolicyUrl)addOne(C.cookiePolicyUrl,C.ui.cookiePolicy);
 }
-function openReopenPanel(){
-if(root.querySelector(".emprivacy-bar--reopen"))return;
+function addVendorDisclosure(parent){
+if(!C.vendors||!C.vendors.length)return;
+var det=document.createElement("details");
+det.className="emprivacy-vendors";
+var sum=document.createElement("summary");
+sum.appendChild(document.createTextNode(C.ui.vendorsHeading));
+det.appendChild(sum);
+var ul=document.createElement("ul");
+C.vendors.forEach(function(v){
+var li=document.createElement("li");
+var strong=document.createElement("strong");
+strong.appendChild(document.createTextNode(v.name));
+li.appendChild(strong);
+li.appendChild(document.createTextNode(" ("+v.category+") — "+v.purpose));
+if(v.policyUrl&&parseHttps(v.policyUrl)){
+li.appendChild(document.createTextNode(" "));
+var a=document.createElement("a");
+a.href=v.policyUrl;
+a.rel="nofollow noopener";
+a.target="_blank";
+a.appendChild(document.createTextNode(C.ui.whatWeUse));
+li.appendChild(a);
+}
+ul.appendChild(li);
+});
+det.appendChild(ul);
+parent.appendChild(det);
+}
+function mkRow(label,id,on,locked){
+var w=document.createElement("label");
+w.className="emprivacy-switch";
+var cb=document.createElement("input");
+cb.type="checkbox";
+cb.id=id;
+cb.checked=on;
+if(locked){cb.checked=true;cb.disabled=true;}
+w.appendChild(cb);
+w.appendChild(document.createTextNode(" "+label));
+return {wrap:w,box:cb};
+}
+var openPanel=function(){};
+function installApi(){
+var api=Object.freeze({
+get:function(){return currentState();},
+has:function(cat){
+if(cat==="essential")return true;
+var st=currentState();
+if(!st)return false;
+if(cat==="functional")return !!st.functional;
+if(cat==="analytics")return !!st.analytics;
+if(cat==="marketing")return !!st.marketing;
+return false;
+},
+onChange:function(cb){
+if(typeof cb!=="function")return function(){};
+listeners.push(cb);
+return function(){listeners=listeners.filter(function(x){return x!==cb;});};
+},
+open:function(){openPanel();}
+});
+try{Object.defineProperty(window,"emprivacy",{value:api,writable:false,configurable:false});}catch(e){window.emprivacy=api;}
+}
+function applyTheme(root){
+try{
+root.style.setProperty("--emprivacy-bg",C.theme.bg);
+root.style.setProperty("--emprivacy-text",C.theme.text);
+root.style.setProperty("--emprivacy-accent",C.theme.accent);
+root.style.setProperty("--emprivacy-radius",String(C.theme.radiusPx)+"px");
+}catch(e){}
+}
+function mount(){
+var root=document.getElementById("emprivacy-root");
+if(!root)return;
+applyTheme(root);
+var initial=currentState();
+if(initial) hydrateEmbeds(initial);
+var trigger=document.createElement("button");
+trigger.type="button";
+trigger.className="emprivacy-cookie-trigger";
+trigger.setAttribute("aria-label",C.ui.cookieSettings);
+var ic=document.createElement("span");
+ic.setAttribute("aria-hidden","true");
+ic.className="emprivacy-cookie-trigger-icon";
+ic.appendChild(document.createTextNode("🍪"));
+trigger.appendChild(ic);
+function showTrigger(){trigger.removeAttribute("hidden");}
+function hideTrigger(){trigger.setAttribute("hidden","");}
+function buildPanel(isReopen,hint){
 var st=parseState(readCookie());
-if(!st)return;
-hideTrigger();
-var aOn=!!st.a;
-var mOn=!!st.m;
+var aOn=st?!!st.analytics:(C.strictDefaults?false:true);
+var mOn=st?!!st.marketing:(C.strictDefaults?false:true);
+var fOn=st?!!st.functional:(C.strictDefaults?false:true);
+if(isReopen) hideTrigger();
 var bar=document.createElement("div");
-bar.className="emprivacy-bar emprivacy-bar--reopen";
+bar.className="emprivacy-bar"+(isReopen?" emprivacy-bar--reopen":"");
 bar.setAttribute("role","dialog");
-bar.setAttribute("aria-modal","true");
+bar.setAttribute("aria-modal",isReopen?"true":"false");
 var title=document.createElement("h2");
 title.className="emprivacy-title";
 title.appendChild(document.createTextNode(C.bannerTitle));
@@ -379,132 +1184,399 @@ links.className="emprivacy-links";
 addPolicyLinks(links);
 var opts=document.createElement("div");
 opts.className="emprivacy-opts";
-var er=mkRow("Analytics","emprivacy-ra",aOn);
-var mr=mkRow("Marketing","emprivacy-rm",mOn);
+if(!isReopen) opts.setAttribute("hidden","");
+if(hint){
+var hintEl=document.createElement("p");
+hintEl.className="emprivacy-note";
+hintEl.appendChild(document.createTextNode(hint));
+opts.appendChild(hintEl);
+show(opts);
+}
+var ess=mkRow(C.ui.essential,isReopen?"emprivacy-re":"emprivacy-e",true,true);
+var note=document.createElement("p");
+note.className="emprivacy-note";
+note.appendChild(document.createTextNode(C.ui.essentialNote));
+var fr=mkRow(C.ui.functional,isReopen?"emprivacy-rf":"emprivacy-f",fOn,false);
+var er=mkRow(C.ui.analytics,isReopen?"emprivacy-ra":"emprivacy-a",aOn,false);
+var mr=mkRow(C.ui.marketing,isReopen?"emprivacy-rm":"emprivacy-m",mOn,false);
+opts.appendChild(ess.wrap);
+opts.appendChild(note);
+opts.appendChild(fr.wrap);
 opts.appendChild(er.wrap);
 opts.appendChild(mr.wrap);
+addVendorDisclosure(opts);
 var actions=document.createElement("div");
 actions.className="emprivacy-actions";
-function doReopenPersist(a,m){
-writeCookie(JSON.stringify({v:C.policyVersion,a:a?1:0,m:m?1:0}));
-logServer(a,m);
-location.reload();
-}
 var btnAll=document.createElement("button");
 btnAll.type="button";
 btnAll.className="emprivacy-btn emprivacy-btn-primary";
-btnAll.appendChild(document.createTextNode("Accept all"));
-btnAll.addEventListener("click",function(){doReopenPersist(true,true);});
+btnAll.appendChild(document.createTextNode(C.ui.acceptAll));
+btnAll.addEventListener("click",function(){persist(true,true,true);});
 var btnRej=document.createElement("button");
 btnRej.type="button";
 btnRej.className="emprivacy-btn";
-btnRej.appendChild(document.createTextNode("Reject non-essential"));
-btnRej.addEventListener("click",function(){doReopenPersist(false,false);});
+btnRej.appendChild(document.createTextNode(C.ui.rejectNonEssential));
+btnRej.addEventListener("click",function(){persist(false,false,false);});
 var btnSave=document.createElement("button");
 btnSave.type="button";
 btnSave.className="emprivacy-btn emprivacy-btn-primary";
-btnSave.appendChild(document.createTextNode("Save choices"));
-btnSave.addEventListener("click",function(){doReopenPersist(!!er.box.checked,!!mr.box.checked);});
+if(!isReopen&&!hint) btnSave.setAttribute("hidden","");
+btnSave.appendChild(document.createTextNode(C.ui.saveChoices));
+btnSave.addEventListener("click",function(){persist(!!er.box.checked,!!mr.box.checked,!!fr.box.checked);});
+actions.appendChild(btnAll);
+actions.appendChild(btnRej);
+if(!isReopen){
+var btnCust=document.createElement("button");
+btnCust.type="button";
+btnCust.className="emprivacy-btn";
+btnCust.appendChild(document.createTextNode(C.ui.customize));
+btnCust.addEventListener("click",function(){show(opts);btnSave.removeAttribute("hidden");});
+actions.appendChild(btnCust);
+}else{
 var btnClose=document.createElement("button");
 btnClose.type="button";
 btnClose.className="emprivacy-btn";
-btnClose.appendChild(document.createTextNode("Close"));
+btnClose.appendChild(document.createTextNode(C.ui.close));
 btnClose.addEventListener("click",function(){
 if(bar.parentNode)bar.parentNode.removeChild(bar);
 showTrigger();
 });
-actions.appendChild(btnAll);
-actions.appendChild(btnRej);
-actions.appendChild(btnSave);
 actions.appendChild(btnClose);
+}
+actions.appendChild(btnSave);
 bar.appendChild(title);
 bar.appendChild(msg);
 bar.appendChild(links);
 bar.appendChild(opts);
 bar.appendChild(actions);
-root.appendChild(bar);
+return bar;
+}
+function openReopenPanel(hint){
+if(root.querySelector(".emprivacy-bar--reopen"))return;
+var st=parseState(readCookie());
+if(!st)return;
+root.appendChild(buildPanel(true,hint||""));
+}
+openPanel=function(hint){
+var st=parseState(readCookie());
+if(st) openReopenPanel(hint);
+else{
+var existing=root.querySelector(".emprivacy-bar");
+if(existing){
+if(hint){
+var note=document.createElement("p");
+note.className="emprivacy-note";
+note.appendChild(document.createTextNode(hint));
+var opts=existing.querySelector(".emprivacy-opts");
+if(opts){opts.insertBefore(note,opts.firstChild);show(opts);}
+}
+try{existing.scrollIntoView({block:"end"});}catch(e){}
+}
 }
+};
 root.appendChild(trigger);
 hideTrigger();
+function wireEmbedButtons(){
+document.addEventListener("click",function(ev){
+var t=ev.target;
+if(!t||!t.closest)return;
+var btn=t.closest("[data-emprivacy-embed-load]");
+if(!btn)return;
+ev.preventDefault();
+if(!C.gateEmbeds)return;
+var st=currentState();
+if(st&&embedAllowed(st)){
+hydrateEmbeds(st);
+return;
+}
+openPanel(C.ui.embedNeedConsent);
+});
+}
+wireEmbedButtons();
 if(!needBanner()){
 var st=parseState(readCookie());
-applyScripts(!!(st&&st.a),!!(st&&st.m));
-gtagUpdate(!!(st&&st.a),!!(st&&st.m));
+if(st){
+applyScripts(st);
+gtagUpdate(st);
+hydrateEmbeds(st);
+}
 showTrigger();
 trigger.addEventListener("click",function(){openReopenPanel();});
+installApi();
 return;
 }
-var aOn=C.strictDefaults?false:true;
-var mOn=C.strictDefaults?false:true;
-var bar=document.createElement("div");
-bar.className="emprivacy-bar";
-bar.setAttribute("role","dialog");
-bar.setAttribute("aria-modal","false");
-var title=document.createElement("h2");
-title.className="emprivacy-title";
-title.appendChild(document.createTextNode(C.bannerTitle));
-var msg=document.createElement("p");
-msg.className="emprivacy-msg";
-msg.appendChild(document.createTextNode(C.bannerMessage));
-var links=document.createElement("div");
-links.className="emprivacy-links";
-addPolicyLinks(links);
-var opts=document.createElement("div");
-opts.className="emprivacy-opts";
-opts.setAttribute("hidden","");
-var er=mkRow("Analytics","emprivacy-a",aOn);
-var mr=mkRow("Marketing","emprivacy-m",mOn);
-opts.appendChild(er.wrap);
-opts.appendChild(mr.wrap);
-var actions=document.createElement("div");
-actions.className="emprivacy-actions";
-function persist(a,m){
-writeCookie(JSON.stringify({v:C.policyVersion,a:a?1:0,m:m?1:0}));
-logServer(a,m);
-// For Cloudflare Web Analytics (and most tag-based analytics), injecting after load can miss the initial pageview.
-// Reload ensures the script runs in the normal page lifecycle immediately after consent is persisted.
-location.reload();
-}
-var btnAll=document.createElement("button");
-btnAll.type="button";
-btnAll.className="emprivacy-btn emprivacy-btn-primary";
-btnAll.appendChild(document.createTextNode("Accept all"));
-btnAll.addEventListener("click",function(){persist(true,true);});
-var btnRej=document.createElement("button");
-btnRej.type="button";
-btnRej.className="emprivacy-btn";
-btnRej.appendChild(document.createTextNode("Reject non-essential"));
-btnRej.addEventListener("click",function(){persist(false,false);});
-var btnCust=document.createElement("button");
-btnCust.type="button";
-btnCust.className="emprivacy-btn";
-btnCust.appendChild(document.createTextNode("Customize"));
-btnCust.addEventListener("click",function(){show(opts);btnSave.removeAttribute("hidden");});
-var btnSave=document.createElement("button");
-btnSave.type="button";
-btnSave.className="emprivacy-btn emprivacy-btn-primary";
-btnSave.setAttribute("hidden","");
-btnSave.appendChild(document.createTextNode("Save choices"));
-btnSave.addEventListener("click",function(){persist(!!er.box.checked,!!mr.box.checked);});
-actions.appendChild(btnAll);
-actions.appendChild(btnRej);
-actions.appendChild(btnCust);
-actions.appendChild(btnSave);
-bar.appendChild(title);
-bar.appendChild(msg);
-bar.appendChild(links);
-bar.appendChild(opts);
-bar.appendChild(actions);
-root.appendChild(bar);
+root.appendChild(buildPanel(false,""));
+trigger.addEventListener("click",function(){openReopenPanel();});
+installApi();
 }
 if(document.readyState==="loading")document.addEventListener("DOMContentLoaded",mount);
 else mount();
 })();`;
 }
-/**
-* Native EmDash runtime — loaded via the named `createPlugin` export.
-* Uses `page:fragments`, which requires trusted in-process (native) execution.
-*/
+function buildGoogleConsentHeadScript() {
+	return `(function(){window.dataLayer=window.dataLayer||[];function g(){window.dataLayer.push(arguments);}window.gtag=g;g("consent","default",{"analytics_storage":"denied","ad_storage":"denied","ad_user_data":"denied","ad_personalization":"denied","functionality_storage":"denied","security_storage":"granted","personalization_storage":"denied"});})();`;
+}
+//#endregion
+//#region src/vendors.ts
+const PLAUSIBLE_SCRIPT = "https://plausible.io/js/script.js";
+const FATHOM_SCRIPT = "https://cdn.usefathom.com/script.js";
+const SIMPLE_SCRIPT = "https://scripts.simpleanalyticscdn.com/latest.js";
+function buildAnalyticsLoader(cfg) {
+	switch (cfg.analyticsProvider) {
+		case "none": return { type: "none" };
+		case "cloudflare": return cfg.cloudflareWebAnalyticsToken ? {
+			type: "cloudflare",
+			token: cfg.cloudflareWebAnalyticsToken
+		} : { type: "none" };
+		case "custom": return cfg.analyticsScriptUrls.length ? {
+			type: "custom",
+			scripts: cfg.analyticsScriptUrls.map((src) => ({
+				src,
+				integrity: cfg.scriptIntegrity[src] ?? null
+			}))
+		} : { type: "none" };
+		case "plausible": return isHostname$1(cfg.analyticsId) ? {
+			type: "plausible",
+			src: PLAUSIBLE_SCRIPT,
+			domain: cfg.analyticsId.trim().toLowerCase()
+		} : { type: "none" };
+		case "fathom": return isFathomId(cfg.analyticsId) ? {
+			type: "fathom",
+			src: FATHOM_SCRIPT,
+			siteId: cfg.analyticsId.trim()
+		} : { type: "none" };
+		case "umami": return isUmamiId(cfg.analyticsId) && cfg.umamiScriptUrl ? {
+			type: "umami",
+			src: cfg.umamiScriptUrl,
+			websiteId: cfg.analyticsId.trim()
+		} : { type: "none" };
+		case "simpleanalytics": return {
+			type: "simpleanalytics",
+			src: SIMPLE_SCRIPT
+		};
+		case "ga4": return isGa4Id(cfg.analyticsId) ? {
+			type: "ga4",
+			measurementId: cfg.analyticsId.trim()
+		} : { type: "none" };
+		case "gtm": return isGtmId(cfg.analyticsId) ? {
+			type: "gtm",
+			containerId: cfg.analyticsId.trim()
+		} : { type: "none" };
+		default: return { type: "none" };
+	}
+}
+function buildVendorList(cfg) {
+	const rows = [{
+		id: "emprivacy",
+		name: "EmPrivacy consent cookie",
+		category: "essential",
+		purpose: "Stores your category choices (`emprivacy_cc`) so the banner does not reappear every visit."
+	}];
+	if (cfg.gateEmbeds) rows.push({
+		id: "embeds",
+		name: "Third-party embeds (YouTube, Vimeo, social posts, Gists)",
+		category: cfg.embedCategory,
+		purpose: "Loads official EmDash embed blocks only after this category is allowed. Unknown or unsafe embed URLs are never framed."
+	});
+	const loader = buildAnalyticsLoader(cfg);
+	if (loader.type === "cloudflare") rows.push({
+		id: "cloudflare-wa",
+		name: "Cloudflare Web Analytics",
+		category: "analytics",
+		purpose: "Privacy-oriented page analytics via Cloudflare’s beacon after Analytics consent.",
+		policyUrl: "https://www.cloudflare.com/privacypolicy/"
+	});
+	else if (loader.type === "plausible") rows.push({
+		id: "plausible",
+		name: "Plausible Analytics",
+		category: "analytics",
+		purpose: "Cookieless first-party analytics loaded after Analytics consent.",
+		policyUrl: "https://plausible.io/privacy"
+	});
+	else if (loader.type === "fathom") rows.push({
+		id: "fathom",
+		name: "Fathom Analytics",
+		category: "analytics",
+		purpose: "Privacy-focused analytics loaded after Analytics consent.",
+		policyUrl: "https://usefathom.com/privacy"
+	});
+	else if (loader.type === "umami") rows.push({
+		id: "umami",
+		name: "Umami",
+		category: "analytics",
+		purpose: "Self-hosted or Umami Cloud analytics loaded after Analytics consent.",
+		policyUrl: "https://umami.is/privacy"
+	});
+	else if (loader.type === "simpleanalytics") rows.push({
+		id: "simpleanalytics",
+		name: "Simple Analytics",
+		category: "analytics",
+		purpose: "Privacy-focused analytics loaded after Analytics consent.",
+		policyUrl: "https://www.simpleanalytics.com/privacy-policy"
+	});
+	else if (loader.type === "ga4") rows.push({
+		id: "ga4",
+		name: "Google Analytics 4",
+		category: "analytics",
+		purpose: "Google Analytics loaded after Analytics consent. Enable Google Consent Mode if you also use Google tags.",
+		policyUrl: "https://policies.google.com/privacy"
+	});
+	else if (loader.type === "gtm") rows.push({
+		id: "gtm",
+		name: "Google Tag Manager",
+		category: "marketing",
+		purpose: "Loads GTM only after Marketing consent (containers often fire ads/remarketing). You remain responsible for tags inside the container.",
+		policyUrl: "https://policies.google.com/privacy"
+	});
+	else if (loader.type === "custom") for (const [i, script] of loader.scripts.entries()) {
+		let host = "custom script";
+		try {
+			host = new URL(script.src).hostname;
+		} catch {}
+		rows.push({
+			id: `custom-analytics-${i}`,
+			name: `Custom analytics (${host})`,
+			category: "analytics",
+			purpose: "A script URL you configured. Loaded only after Analytics consent."
+		});
+	}
+	for (const [i, src] of cfg.marketingScriptUrls.entries()) {
+		let host = "custom script";
+		try {
+			host = new URL(src).hostname;
+		} catch {}
+		rows.push({
+			id: `marketing-${i}`,
+			name: `Marketing script (${host})`,
+			category: "marketing",
+			purpose: "A marketing or advertising script you configured. Loaded only after Marketing consent."
+		});
+	}
+	if (cfg.googleConsentMode) rows.push({
+		id: "gcm",
+		name: "Google Consent Mode v2",
+		category: "essential",
+		purpose: "Sets denied-by-default Google consent signals in the page; updates after the visitor chooses.",
+		policyUrl: "https://support.google.com/tagmanager/answer/13695607"
+	});
+	return rows;
+}
+//#endregion
+//#region src/version.ts
+const VERSION = "3.0.0";
+//#endregion
+//#region src/runtime.ts
+/** Soft cap for anonymous consent POSTs per client fingerprint per UTC hour. */
+const RECORD_RATE_LIMIT = 30;
+const RECORD_LOG_CAP = 500;
+const ADMIN_SETTINGS_PATH = "/settings";
+const SAVE_ACTION_ID = "emprivacy-save";
+const recordInput = z.object({
+	policyVersion: z.string().trim().min(1).max(64),
+	functional: z.boolean(),
+	analytics: z.boolean(),
+	marketing: z.boolean()
+});
+async function loadConfig(ctx) {
+	const raw = await ctx.kv.get(KV_KEY);
+	if (!raw) return normalizeConfig({});
+	try {
+		return normalizeConfig(JSON.parse(raw));
+	} catch {
+		return normalizeConfig({});
+	}
+}
+async function saveConfigString(ctx, json) {
+	await ctx.kv.set(KV_KEY, json);
+}
+function recordPathForSite() {
+	return `/_emdash/api/plugins/${PLUGIN_ID}/record`;
+}
+function absolutePolicyHref(stored, ctx) {
+	const r = resolvePolicyHref(stored, ctx).trim();
+	if (!r) return null;
+	try {
+		if (new URL(r).protocol !== "https:") return null;
+		return r;
+	} catch {
+		return null;
+	}
+}
+function clientFingerKey(request) {
+	const cf = request.headers.get("cf-connecting-ip")?.trim();
+	const xff = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim();
+	const ua = (request.headers.get("user-agent") ?? "").slice(0, 120);
+	return `${cf || xff || "unknown"}|${ua}`;
+}
+async function hashFinger(s) {
+	const data = new TextEncoder().encode(`emprivacy-rl:${s}`);
+	const dig = await crypto.subtle.digest("SHA-256", data);
+	return Array.from(new Uint8Array(dig)).map((b) => b.toString(16).padStart(2, "0")).join("").slice(0, 32);
+}
+async function allowRecordWrite(ctx, request) {
+	const key = `consent:rl:${rateHourKey()}:${await hashFinger(clientFingerKey(request))}`;
+	try {
+		const raw = await ctx.kv.get(key);
+		const n = raw && /^\d{1,6}$/.test(raw) ? Number(raw) : 0;
+		if (n >= RECORD_RATE_LIMIT) return false;
+		await ctx.kv.set(key, String(n + 1));
+		return true;
+	} catch {
+		return false;
+	}
+}
+function publicRuntime(cfg, ctx, page) {
+	const copy = resolvePublicCopy(cfg, page.locale);
+	const hideBanner = cfg.hideBannerOnPolicyPages && isPolicyPagePath(page.path, cfg);
+	return {
+		bannerTitle: copy.bannerTitle,
+		bannerMessage: copy.bannerMessage,
+		privacyPolicyUrl: absolutePolicyHref(cfg.privacyPolicyUrl, ctx) ?? "",
+		cookiePolicyUrl: cfg.cookiePolicyUrl ? absolutePolicyHref(cfg.cookiePolicyUrl, ctx) ?? "" : "",
+		strictDefaults: cfg.strictDefaults,
+		policyVersion: cfg.policyVersion,
+		googleConsentMode: cfg.googleConsentMode,
+		logConsent: cfg.logConsentToServer,
+		recordPath: recordPathForSite(),
+		embedCategory: cfg.embedCategory,
+		gateEmbeds: cfg.gateEmbeds,
+		hideBanner,
+		theme: cfg.theme,
+		ui: copy.ui,
+		loader: buildAnalyticsLoader(cfg),
+		marketingScripts: cfg.marketingScriptUrls.map((src) => ({
+			src,
+			integrity: cfg.scriptIntegrity[src] ?? null
+		})),
+		scriptHostAllowlist: cfg.scriptHostAllowlist,
+		scriptIntegrity: cfg.scriptIntegrity,
+		cookieMaxAge: cookieMaxAgeSeconds(cfg.cookieMaxAgeDays),
+		vendors: buildVendorList(cfg)
+	};
+}
+function themeStyle() {
+	return `<style id="emprivacy-style">
+#emprivacy-root{font-family:system-ui,sans-serif;font-size:14px;--emprivacy-bg:#111111;--emprivacy-text:#eeeeee;--emprivacy-accent:#3b82f6;--emprivacy-radius:6px}
+.emprivacy-bar{position:fixed;z-index:99999;left:0;right:0;bottom:0;background:var(--emprivacy-bg);color:var(--emprivacy-text);padding:16px 20px 20px;box-shadow:0 -4px 24px rgba(0,0,0,.25);max-height:45vh;overflow:auto}
+.emprivacy-title{margin:0 0 8px;font-size:1.1rem}
+.emprivacy-msg,.emprivacy-note{margin:0 0 10px;line-height:1.4;opacity:.95}
+.emprivacy-note{font-size:.85rem}
+.emprivacy-links a{color:var(--emprivacy-accent);margin-right:12px}
+.emprivacy-opts{margin:10px 0;border-top:1px solid color-mix(in srgb,var(--emprivacy-text) 20%,transparent);padding-top:10px}
+.emprivacy-switch{display:block;margin:6px 0}
+.emprivacy-actions{display:flex;flex-wrap:wrap;gap:8px;margin-top:10px}
+.emprivacy-btn{border-radius:var(--emprivacy-radius);border:1px solid color-mix(in srgb,var(--emprivacy-text) 35%,transparent);background:transparent;color:var(--emprivacy-text);padding:8px 12px;cursor:pointer}
+.emprivacy-btn-primary{background:var(--emprivacy-accent);border-color:var(--emprivacy-accent);color:#fff}
+.emprivacy-cookie-trigger{position:fixed;z-index:99998;left:16px;bottom:16px;width:48px;height:48px;border-radius:50%;border:1px solid color-mix(in srgb,var(--emprivacy-text) 35%,transparent);background:var(--emprivacy-bg);color:var(--emprivacy-text);box-shadow:0 2px 12px rgba(0,0,0,.2);cursor:pointer;padding:0;display:flex;align-items:center;justify-content:center}
+.emprivacy-cookie-trigger:hover{filter:brightness(1.1)}
+.emprivacy-cookie-trigger:focus{outline:2px solid var(--emprivacy-accent);outline-offset:2px}
+.emprivacy-cookie-trigger[hidden]{display:none!important}
+.emprivacy-cookie-trigger-icon{font-size:1.35rem;line-height:1}
+.emprivacy-bar--reopen{z-index:100000}
+.emprivacy-vendors{margin:10px 0 0}
+.emprivacy-vendors ul{margin:8px 0 0;padding-left:1.2rem}
+</style>`;
+}
 function createPlugin() {
 	return definePlugin({
 		id: PLUGIN_ID,
@@ -518,7 +1590,7 @@ function createPlugin() {
 		}] },
 		hooks: {
 			"plugin:install": async (_e, ctx) => {
-				if (!await ctx.kv.get(KV_KEY)) {
+				if (!await ctx.kv.get("consent:config")) {
 					await saveConfigString(ctx, JSON.stringify(normalizeConfig({})));
 					ctx.log.info("EmPrivacy: seeded default configuration");
 				}
@@ -542,47 +1614,14 @@ function createPlugin() {
 				});
 				return out.length ? out : null;
 			} },
-			"page:fragments": { handler: async (_e, ctx) => {
+			"page:fragments": { handler: async (e, ctx) => {
 				const cfg = await loadConfig(ctx);
-				const privacyResolved = absolutePolicyHref(cfg.privacyPolicyUrl, ctx) ?? "";
-				const cookieResolved = cfg.cookiePolicyUrl ? absolutePolicyHref(cfg.cookiePolicyUrl, ctx) ?? "" : "";
-				const pr = {
-					bannerTitle: cfg.bannerTitle,
-					bannerMessage: cfg.bannerMessage,
-					privacyPolicyUrl: privacyResolved,
-					cookiePolicyUrl: cookieResolved,
-					strictDefaults: cfg.strictDefaults,
-					policyVersion: cfg.policyVersion,
-					analyticsProvider: cfg.analyticsProvider,
-					cloudflareToken: cfg.cloudflareWebAnalyticsToken,
-					analyticsScriptUrls: cfg.analyticsScriptUrls,
-					marketingScriptUrls: cfg.marketingScriptUrls,
-					googleConsentMode: cfg.googleConsentMode,
-					logConsent: cfg.logConsentToServer,
-					recordPath: recordPathForSite()
-				};
+				const pr = publicRuntime(cfg, ctx, e.page);
 				const style = {
 					kind: "html",
 					placement: "body:end",
 					key: "emprivacy:style",
-					html: `<style id="emprivacy-style">
-#emprivacy-root{font-family:system-ui,sans-serif;font-size:14px}
-.emprivacy-bar{position:fixed;z-index:99999;left:0;right:0;bottom:0;background:#111;color:#eee;padding:16px 20px 20px;box-shadow:0 -4px 24px rgba(0,0,0,.25);max-height:45vh;overflow:auto}
-.emprivacy-title{margin:0 0 8px;font-size:1.1rem}
-.emprivacy-msg{margin:0 0 10px;line-height:1.4;opacity:.95}
-.emprivacy-links a{color:#8ecbff;margin-right:12px}
-.emprivacy-opts{margin:10px 0;border-top:1px solid #333;padding-top:10px}
-.emprivacy-switch{display:block;margin:6px 0}
-.emprivacy-actions{display:flex;flex-wrap:wrap;gap:8px;margin-top:10px}
-.emprivacy-btn{border-radius:6px;border:1px solid #555;background:#222;color:#eee;padding:8px 12px;cursor:pointer}
-.emprivacy-btn-primary{background:#3b82f6;border-color:#3b82f6;color:#fff}
-.emprivacy-cookie-trigger{position:fixed;z-index:99998;left:16px;bottom:16px;width:48px;height:48px;border-radius:50%;border:1px solid #555;background:#222;color:#e8b86d;box-shadow:0 2px 12px rgba(0,0,0,.2);cursor:pointer;padding:0;display:flex;align-items:center;justify-content:center}
-.emprivacy-cookie-trigger:hover{background:#2a2a2a}
-.emprivacy-cookie-trigger:focus{outline:2px solid #3b82f6;outline-offset:2px}
-.emprivacy-cookie-trigger[hidden]{display:none!important}
-.emprivacy-cookie-trigger-icon{font-size:1.35rem;line-height:1}
-.emprivacy-bar--reopen{z-index:100000}
-</style>`
+					html: themeStyle()
 				};
 				const shell = {
 					kind: "html",
@@ -633,10 +1672,23 @@ function createPlugin() {
 							policyVersion: String(v.policy_version ?? ""),
 							analyticsPlatform: String(v.analytics_platform ?? "cloudflare"),
 							cloudflareToken: String(v.cloudflare_token ?? ""),
+							analyticsId: String(v.analytics_id ?? ""),
+							umamiScriptUrl: String(v.umami_script_url ?? ""),
 							analyticsUrlsText: String(v.analytics_urls ?? ""),
 							marketingUrlsText: String(v.marketing_urls ?? ""),
+							scriptHostAllowlistText: String(v.script_host_allowlist ?? ""),
+							cookieMaxAgeDays: String(v.cookie_max_age_days ?? "180"),
 							googleConsentMode: asBool(v.google_cm),
-							logConsentToServer: asBool(v.log_server)
+							logConsentToServer: asBool(v.log_server),
+							embedCategory: String(v.embed_category ?? "marketing"),
+							gateEmbeds: asBool(v.gate_embeds),
+							hideBannerOnPolicyPages: asBool(v.hide_on_policy),
+							defaultLocale: String(v.default_locale ?? "en"),
+							localeOverridesText: String(v.locale_overrides ?? ""),
+							themeBg: String(v.theme_bg ?? ""),
+							themeText: String(v.theme_text ?? ""),
+							themeAccent: String(v.theme_accent ?? ""),
+							themeRadius: String(v.theme_radius ?? "")
 						});
 						await saveConfigString(ctx, JSON.stringify(next));
 						return {
@@ -663,15 +1715,15 @@ function createPlugin() {
 				public: true,
 				input: recordInput,
 				handler: async (ctx) => {
-					if (ctx.request.method !== "POST") return { ok: false };
+					if (ctx.request.method !== "POST") return new Response("method_not_allowed", { status: 405 });
+					let expectedOrigin;
 					try {
-						const origin = ctx.request.headers.get("origin");
-						if (origin) {
-							if (origin !== new URL(ctx.url("/")).origin) return new Response("forbidden", { status: 403 });
-						}
+						expectedOrigin = new URL(ctx.url("/")).origin;
 					} catch {
 						return new Response("bad_request", { status: 400 });
 					}
+					const csrf = assertSameOriginMutation(ctx.request, expectedOrigin);
+					if (csrf) return csrf;
 					if (!(ctx.request.headers.get("content-type") ?? "").toLowerCase().includes("application/json")) return new Response("unsupported_media_type", { status: 415 });
 					const cfg = await loadConfig(ctx);
 					if (!cfg.logConsentToServer) return {
@@ -680,34 +1732,60 @@ function createPlugin() {
 					};
 					const input = ctx.input;
 					if (input.policyVersion !== cfg.policyVersion) return new Response("policy_version_mismatch", { status: 400 });
+					if (!await allowRecordWrite(ctx, ctx.request)) return new Response("rate_limited", { status: 429 });
 					const row = {
 						createdAt: (/* @__PURE__ */ new Date()).toISOString(),
 						policyVersion: input.policyVersion,
+						functional: input.functional,
 						analytics: input.analytics,
 						marketing: input.marketing
 					};
 					try {
 						if ((await ctx.storage.consentEvents.query({
 							orderBy: { createdAt: "desc" },
-							limit: 500
-						})).items.length >= 500) return {
+							limit: RECORD_LOG_CAP
+						})).items.length >= RECORD_LOG_CAP) return {
 							ok: false,
 							reason: "log_full"
 						};
-					} catch {}
+					} catch {
+						return {
+							ok: false,
+							reason: "storage_unavailable"
+						};
+					}
 					await ctx.storage.consentEvents.put(`${Date.now()}-${Math.random().toString(36).slice(2)}`, row);
 					return { ok: true };
 				}
+			},
+			vendors: {
+				public: true,
+				handler: async (ctx) => {
+					if (ctx.request.method !== "GET") return new Response("method_not_allowed", { status: 405 });
+					return { vendors: buildVendorList(await loadConfig(ctx)) };
+				}
 			}
 		}
 	});
 }
 async function buildSettingsPage(ctx) {
-	const cfg = await loadConfig(ctx);
-	const analyticsText = cfg.analyticsScriptUrls.join("\n");
-	const marketingText = cfg.marketingScriptUrls.join("\n");
+	const [cfg, latestPublished] = await Promise.all([loadConfig(ctx), fetchLatestPublishedVersion({ fetch: ctx.http?.fetch ?? globalThis.fetch })]);
+	const installedVersion = ctx.plugin?.version ?? "3.0.0";
+	const analyticsText = cfg.analyticsScriptUrls.map((src) => {
+		const i = cfg.scriptIntegrity[src];
+		return i ? `${src} ${i}` : src;
+	}).join("\n");
+	const marketingText = cfg.marketingScriptUrls.map((src) => {
+		const i = cfg.scriptIntegrity[src];
+		return i ? `${src} ${i}` : src;
+	}).join("\n");
 	const platform = cfg.analyticsProvider;
 	const docsUrl = "https://github.com/EmPlugins/EmPrivacy/blob/main/docs/PLUGIN_SETTINGS.md";
+	const vendorFields = buildVendorList(cfg).map((v) => ({
+		label: `${v.name} · ${v.category}`,
+		value: v.purpose
+	}));
+	const localeOverridesText = Object.keys(cfg.localeOverrides).length > 0 ? JSON.stringify(cfg.localeOverrides, null, 2) : "";
 	const consentFields = await (async () => {
 		try {
 			return (await ctx.storage.consentEvents.query({
@@ -715,9 +1793,10 @@ async function buildSettingsPage(ctx) {
 				limit: 15
 			})).items.map((item) => {
 				const d = item.data;
+				const functional = typeof d.functional === "boolean" ? ` · functional ${d.functional ? "on" : "off"}` : "";
 				return {
 					label: d.createdAt,
-					value: `policy ${d.policyVersion} · analytics ${d.analytics ? "on" : "off"} · marketing ${d.marketing ? "on" : "off"}`
+					value: `policy ${d.policyVersion}${functional} · analytics ${d.analytics ? "on" : "off"} · marketing ${d.marketing ? "on" : "off"}`
 				};
 			});
 		} catch {
@@ -729,17 +1808,25 @@ async function buildSettingsPage(ctx) {
 			type: "header",
 			text: "EmPrivacy — Cookie & consent"
 		},
+		{
+			type: "fields",
+			fields: pluginVersionFields(installedVersion, latestPublished)
+		},
+		{
+			type: "context",
+			text: pluginVersionNote(installedVersion, latestPublished)
+		},
 		{
 			type: "context",
 			text: `Documentation: ${docsUrl}`
 		},
 		{
 			type: "context",
-			text: "Configure the public banner. **Analytics:** pick a platform (Cloudflare is built in — enter your **site token** from Cloudflare → Web Analytics; EmPrivacy injects the standard beacon with `data-cf-beacon` after consent). **None** = no third-party analytics scripts. **Custom** = one `https://` script URL per line, `src` only. **Marketing:** `https` script URLs, one per line, after marketing consent. No arbitrary admin HTML in the public site."
+			text: "This plugin is a technical consent layer, not legal advice and not a privacy-policy generator. You still write and publish the legal pages. EmPrivacy does not scan your theme for leftover trackers, does not geo-locate visitors, and does not block first-party EmDash comments."
 		},
 		{
 			type: "context",
-			text: "Privacy / cookie links: use your EmDash **Page** public path (e.g. `/privacy` — same as in the browser address bar when you view that Page) or a full `https://…` URL if the policy is hosted elsewhere."
+			text: "Privacy / cookie links: use your EmDash **Page** public path (e.g. `/privacy`) or a full `https://…` URL. Banner chrome follows the page locale when a built-in translation exists (en, de, fr, es, it, nl, pt, pl)."
 		},
 		{ type: "divider" },
 		{
@@ -749,16 +1836,31 @@ async function buildSettingsPage(ctx) {
 				{
 					type: "text_input",
 					action_id: "banner_title",
-					label: "Banner title",
+					label: "Banner title (fallback locale)",
 					initial_value: cfg.bannerTitle
 				},
 				{
 					type: "text_input",
 					action_id: "banner_message",
-					label: "Short notice",
+					label: "Short notice (fallback locale)",
 					multiline: true,
 					initial_value: cfg.bannerMessage
 				},
+				{
+					type: "text_input",
+					action_id: "default_locale",
+					label: "Fallback locale code",
+					placeholder: "en",
+					initial_value: cfg.defaultLocale
+				},
+				{
+					type: "text_input",
+					action_id: "locale_overrides",
+					label: "Optional title/message translations (JSON)",
+					placeholder: "{\"de\":{\"bannerTitle\":\"Cookies & Datenschutz\",\"bannerMessage\":\"…\"}}\n",
+					multiline: true,
+					initial_value: localeOverridesText
+				},
 				{
 					type: "text_input",
 					action_id: "privacy_url",
@@ -782,9 +1884,15 @@ async function buildSettingsPage(ctx) {
 				{
 					type: "toggle",
 					action_id: "strict_defaults",
-					label: "Strict defaults (require opt-in for analytics & marketing)",
+					label: "Strict defaults (require opt-in for functional, analytics, and marketing)",
 					initial_value: cfg.strictDefaults
 				},
+				{
+					type: "toggle",
+					action_id: "hide_on_policy",
+					label: "Hide the first-visit banner on privacy and cookie policy pages",
+					initial_value: cfg.hideBannerOnPolicyPages
+				},
 				{
 					type: "radio",
 					action_id: "analytics_platform",
@@ -794,6 +1902,30 @@ async function buildSettingsPage(ctx) {
 							value: "cloudflare",
 							label: "Cloudflare Web Analytics"
 						},
+						{
+							value: "plausible",
+							label: "Plausible"
+						},
+						{
+							value: "fathom",
+							label: "Fathom"
+						},
+						{
+							value: "umami",
+							label: "Umami"
+						},
+						{
+							value: "simpleanalytics",
+							label: "Simple Analytics"
+						},
+						{
+							value: "ga4",
+							label: "Google Analytics 4"
+						},
+						{
+							value: "gtm",
+							label: "Google Tag Manager (requires Marketing consent)"
+						},
 						{
 							value: "none",
 							label: "None"
@@ -816,11 +1948,29 @@ async function buildSettingsPage(ctx) {
 						eq: "cloudflare"
 					}
 				},
+				{
+					type: "text_input",
+					action_id: "analytics_id",
+					label: "Analytics ID (domain, site ID, G-…, or GTM-…)",
+					placeholder: "example.com / G-XXXX / GTM-XXXX",
+					initial_value: cfg.analyticsId
+				},
+				{
+					type: "text_input",
+					action_id: "umami_script_url",
+					label: "Umami script URL (https only)",
+					placeholder: "https://cloud.umami.is/script.js",
+					initial_value: cfg.umamiScriptUrl,
+					condition: {
+						field: "analytics_platform",
+						eq: "umami"
+					}
+				},
 				{
 					type: "text_input",
 					action_id: "analytics_urls",
-					label: "Custom analytics script URLs (one https URL per line, not a <script> tag)",
-					placeholder: "https://… (one per line)",
+					label: "Custom analytics script URLs (one https URL per line; optional trailing SRI: … sha384-…)",
+					placeholder: "https://cdn.example/a.js sha384-…",
 					multiline: true,
 					initial_value: analyticsText,
 					condition: {
@@ -831,21 +1981,83 @@ async function buildSettingsPage(ctx) {
 				{
 					type: "text_input",
 					action_id: "marketing_urls",
-					label: "Marketing script URLs (one https URL per line, not a <script> tag)",
+					label: "Marketing script URLs (one https URL per line; optional trailing SRI: … sha384-…)",
 					placeholder: "https://… (one per line)",
 					multiline: true,
 					initial_value: marketingText
 				},
+				{
+					type: "text_input",
+					action_id: "script_host_allowlist",
+					label: "Script host allowlist (optional; one hostname per line). When set, Custom analytics and marketing URLs must match.",
+					placeholder: "cdn.example.com\njs.stripe.com",
+					multiline: true,
+					initial_value: cfg.scriptHostAllowlist.join("\n")
+				},
+				{
+					type: "text_input",
+					action_id: "cookie_max_age_days",
+					label: "Consent cookie lifetime (days, 1–365, default 180)",
+					placeholder: "180",
+					initial_value: String(cfg.cookieMaxAgeDays)
+				},
 				{
 					type: "toggle",
 					action_id: "google_cm",
 					label: "Google Consent Mode v2 (denied defaults in head; updates after choice)",
 					initial_value: cfg.googleConsentMode
 				},
+				{
+					type: "toggle",
+					action_id: "gate_embeds",
+					label: "Gate official EmDash embed blocks (YouTube, Vimeo, social, Gist)",
+					initial_value: cfg.gateEmbeds
+				},
+				{
+					type: "radio",
+					action_id: "embed_category",
+					label: "Embeds require this category",
+					options: [{
+						value: "marketing",
+						label: "Marketing (recommended for YouTube / social)"
+					}, {
+						value: "functional",
+						label: "Functional"
+					}],
+					initial_value: cfg.embedCategory
+				},
+				{
+					type: "text_input",
+					action_id: "theme_bg",
+					label: "Banner background (hex)",
+					placeholder: "#111111",
+					initial_value: cfg.theme.bg
+				},
+				{
+					type: "text_input",
+					action_id: "theme_text",
+					label: "Banner text (hex)",
+					placeholder: "#eeeeee",
+					initial_value: cfg.theme.text
+				},
+				{
+					type: "text_input",
+					action_id: "theme_accent",
+					label: "Banner accent (hex)",
+					placeholder: "#3b82f6",
+					initial_value: cfg.theme.accent
+				},
+				{
+					type: "text_input",
+					action_id: "theme_radius",
+					label: "Banner corner radius (0–24 px)",
+					placeholder: "6",
+					initial_value: String(cfg.theme.radiusPx)
+				},
 				{
 					type: "toggle",
 					action_id: "log_server",
-					label: "Log consent choices to the server (minimal record; no IP stored)",
+					label: "Log consent choices to the server (minimal record; no IP; rate-limited; Origin/Sec-Fetch-Site required)",
 					initial_value: cfg.logConsentToServer
 				}
 			],
@@ -854,6 +2066,19 @@ async function buildSettingsPage(ctx) {
 				action_id: SAVE_ACTION_ID
 			}
 		},
+		{ type: "divider" },
+		{
+			type: "header",
+			text: "What this site uses"
+		},
+		{
+			type: "context",
+			text: "Generated from your current settings. Paste this into your cookie policy if you want a living vendor list. Also available at `/_emdash/api/plugins/emprivacy/vendors`. Tokens and script IDs are not included."
+		},
+		{
+			type: "fields",
+			fields: vendorFields
+		},
 		...cfg.logConsentToServer && consentFields.length > 0 ? [
 			{ type: "divider" },
 			{
@@ -867,16 +2092,247 @@ async function buildSettingsPage(ctx) {
 		] : []
 	] };
 }
-
+//#endregion
+//#region src/astro/embed-resolve.ts
+/**
+* Validate official EmDash embed block payloads and produce a first-party
+* placeholder plan. Never returns a URL we did not construct or allowlist.
+*/
+const EMBED_BLOCK_TYPES = [
+	"youtube",
+	"vimeo",
+	"tweet",
+	"bluesky",
+	"mastodon",
+	"linkPreview",
+	"gist"
+];
+const YT_ID = /^[A-Za-z0-9_-]{11}$/;
+const VIMEO_ID = /^\d{6,12}$/;
+const TWEET_ID = /^\d{5,20}$/;
+const BSKY_RKEY = /^[a-z0-9]{1,32}$/i;
+const BSKY_HANDLE = /^[a-z0-9.-]{1,253}$/i;
+const GIST_ID = /^[a-f0-9]{8,64}$/i;
+const GIST_USER = /^[A-Za-z0-9-]{1,39}$/;
+const YT_HOSTS = /* @__PURE__ */ new Set([
+	"youtube.com",
+	"www.youtube.com",
+	"m.youtube.com",
+	"youtu.be",
+	"www.youtube-nocookie.com",
+	"youtube-nocookie.com"
+]);
+const VIMEO_HOSTS = /* @__PURE__ */ new Set([
+	"vimeo.com",
+	"www.vimeo.com",
+	"player.vimeo.com"
+]);
+const TWEET_HOSTS = /* @__PURE__ */ new Set([
+	"twitter.com",
+	"www.twitter.com",
+	"x.com",
+	"www.x.com",
+	"mobile.twitter.com"
+]);
+const BSKY_HOSTS = /* @__PURE__ */ new Set(["bsky.app", "www.bsky.app"]);
+const GIST_HOSTS = /* @__PURE__ */ new Set(["gist.github.com"]);
+const POSTER_HOSTS = /* @__PURE__ */ new Set([
+	"i.ytimg.com",
+	"img.youtube.com",
+	"i.vimeocdn.com"
+]);
+function hasUnsafeChars(s) {
+	return /[\u0000-\u001F\u007F\s]/.test(s);
+}
+function parseHttpsUrl(raw) {
+	const t = raw.trim();
+	if (!t || t.length > 2048 || hasUnsafeChars(t)) return null;
+	if (/%0d|%0a|%09|%0b|%0c|%20/i.test(t)) return null;
+	try {
+		const u = new URL(t);
+		if (u.protocol !== "https:") return null;
+		if (u.username || u.password) return null;
+		if (u.hostname === "localhost" || u.hostname.endsWith(".localhost")) return null;
+		return u;
+	} catch {
+		return null;
+	}
+}
+function hostOf(u) {
+	return u.hostname.toLowerCase();
+}
+function youtubeId(raw) {
+	const t = raw.trim();
+	if (YT_ID.test(t)) return t;
+	const u = parseHttpsUrl(t);
+	if (!u || !YT_HOSTS.has(hostOf(u))) return null;
+	if (hostOf(u) === "youtu.be") {
+		const id = u.pathname.replace(/^\//, "").split("/")[0] ?? "";
+		return YT_ID.test(id) ? id : null;
+	}
+	const v = u.searchParams.get("v");
+	if (v && YT_ID.test(v)) return v;
+	const parts = u.pathname.split("/").filter(Boolean);
+	const embedIdx = parts.indexOf("embed");
+	if (embedIdx >= 0) {
+		const id = parts[embedIdx + 1] ?? "";
+		return YT_ID.test(id) ? id : null;
+	}
+	const shortsIdx = parts.indexOf("shorts");
+	if (shortsIdx >= 0) {
+		const id = parts[shortsIdx + 1] ?? "";
+		return YT_ID.test(id) ? id : null;
+	}
+	return null;
+}
+function vimeoId(raw) {
+	const t = raw.trim();
+	if (VIMEO_ID.test(t)) return t;
+	const u = parseHttpsUrl(t);
+	if (!u || !VIMEO_HOSTS.has(hostOf(u))) return null;
+	const parts = u.pathname.split("/").filter(Boolean);
+	const last = parts[parts.length - 1] ?? "";
+	const videoIdx = parts.indexOf("video");
+	if (videoIdx >= 0) {
+		const id = parts[videoIdx + 1] ?? "";
+		return VIMEO_ID.test(id) ? id : null;
+	}
+	return VIMEO_ID.test(last) ? last : null;
+}
+function tweetId(raw) {
+	const t = raw.trim();
+	if (TWEET_ID.test(t)) return t;
+	const u = parseHttpsUrl(t);
+	if (!u || !TWEET_HOSTS.has(hostOf(u))) return null;
+	return /\/status(?:es)?\/(\d{5,20})(?:\/|$)/i.exec(u.pathname)?.[1] ?? null;
+}
+function blueskyHref(raw) {
+	const u = parseHttpsUrl(raw);
+	if (!u || !BSKY_HOSTS.has(hostOf(u))) return null;
+	const m = /^\/profile\/([^/]+)\/post\/([^/]+)\/?$/.exec(u.pathname);
+	if (!m) return null;
+	const handle = m[1] ?? "";
+	const rkey = m[2] ?? "";
+	if (!BSKY_HANDLE.test(handle) || !BSKY_RKEY.test(rkey)) return null;
+	return `https://bsky.app/profile/${handle}/post/${rkey}`;
+}
+function gistHref(raw) {
+	const u = parseHttpsUrl(raw);
+	if (!u || !GIST_HOSTS.has(hostOf(u))) return null;
+	const parts = u.pathname.split("/").filter(Boolean);
+	if (parts.length < 2) return null;
+	const user = parts[0] ?? "";
+	const id = (parts[1] ?? "").replace(/\.js$/i, "");
+	if (!GIST_USER.test(user) || !GIST_ID.test(id)) return null;
+	return `https://gist.github.com/${user}/${id}`;
+}
+function mastodonHref(raw) {
+	const u = parseHttpsUrl(raw);
+	if (!u) return null;
+	if (!/^\/@[^/]+\/\d+\/?$/.test(u.pathname) && !/^\/users\/[^/]+\/statuses\/\d+\/?$/.test(u.pathname)) return null;
+	return `https://${hostOf(u)}${u.pathname.replace(/\/$/, "")}`;
+}
+function posterUrl(raw, kind, mediaId) {
+	if (kind === "youtube" && mediaId && YT_ID.test(mediaId)) return `https://i.ytimg.com/vi/${mediaId}/hqdefault.jpg`;
+	if (typeof raw !== "string") return null;
+	const u = parseHttpsUrl(raw);
+	if (!u || !POSTER_HOSTS.has(hostOf(u))) return null;
+	return u.href;
+}
+function isEmbedBlockType(s) {
+	return EMBED_BLOCK_TYPES.includes(s);
+}
+function resolveEmbed(node) {
+	if (!node || typeof node._type !== "string" || !isEmbedBlockType(node._type)) return null;
+	if (typeof node.id !== "string") return null;
+	const kind = node._type;
+	const rawId = node.id.trim();
+	if (!rawId || rawId.length > 2048) return null;
+	if (kind === "youtube") {
+		const id = youtubeId(rawId);
+		if (!id) return null;
+		return {
+			kind,
+			mode: "iframe",
+			src: `https://www.youtube-nocookie.com/embed/${id}`,
+			label: "YouTube",
+			poster: posterUrl(node.poster, kind, id)
+		};
+	}
+	if (kind === "vimeo") {
+		const id = vimeoId(rawId);
+		if (!id) return null;
+		return {
+			kind,
+			mode: "iframe",
+			src: `https://player.vimeo.com/video/${id}`,
+			label: "Vimeo",
+			poster: posterUrl(node.poster, kind, id)
+		};
+	}
+	if (kind === "tweet") {
+		const id = tweetId(rawId);
+		if (!id) return null;
+		return {
+			kind,
+			mode: "link",
+			src: `https://x.com/i/web/status/${id}`,
+			label: "Post on X",
+			poster: null
+		};
+	}
+	if (kind === "bluesky") {
+		const href = blueskyHref(rawId);
+		if (!href) return null;
+		return {
+			kind,
+			mode: "link",
+			src: href,
+			label: "Bluesky post",
+			poster: null
+		};
+	}
+	if (kind === "mastodon") {
+		const href = mastodonHref(rawId);
+		if (!href) return null;
+		return {
+			kind,
+			mode: "link",
+			src: href,
+			label: "Mastodon post",
+			poster: null
+		};
+	}
+	if (kind === "gist") {
+		const href = gistHref(rawId);
+		if (!href) return null;
+		return {
+			kind,
+			mode: "link",
+			src: href,
+			label: "GitHub Gist",
+			poster: null
+		};
+	}
+	const href = parseHttpsUrl(rawId);
+	if (!href) return null;
+	return {
+		kind: "linkPreview",
+		mode: "link",
+		src: href.href,
+		label: href.hostname,
+		poster: null
+	};
+}
 //#endregion
 //#region src/index.ts
 var src_default = createPlugin;
 /**
 * EmDash native plugin descriptor — add to `plugins: []` in `emdash({ ... })` inside `astro.config`.
 *
-* EmPrivacy uses `page:fragments` (banner + consent scripts), which only runs for **native**
-* plugins registered in `plugins: []`. Do not place this descriptor in `sandboxed: []`.
-* See [Page fragments](https://docs.emdashcms.com/plugins/creating-native-plugins/page-fragments/).
+* EmPrivacy uses `page:fragments` (banner + consent scripts) and optional Portable Text
+* embed placeholders, which only run for **native** plugins in `plugins: []`.
+* Do not place this descriptor in `sandboxed: []`.
 */
 function emprivacyPlugin() {
 	return {
@@ -884,6 +2340,7 @@ function emprivacyPlugin() {
 		version: VERSION,
 		format: "native",
 		entrypoint: "@emplugins/emprivacy",
+		componentsEntry: "@emplugins/emprivacy/astro",
 		adminPages: [{
 			path: "/settings",
 			label: "EmPrivacy",
@@ -891,6 +2348,5 @@ function emprivacyPlugin() {
 		}]
 	};
 }
-
 //#endregion
-export { COOKIE_NAME, DEFAULT_CONFIG, KV_KEY, assertValidCloudflareToken, createPlugin, src_default as default, emprivacyPlugin, isRootRelativeSitePath, isValidPolicyHrefInput, normalizeConfig, resolvePolicyHref };
+export { COOKIE_NAME, DEFAULT_CONFIG, EMBED_BLOCK_TYPES, KV_KEY, assertValidCloudflareToken, buildAnalyticsLoader, buildVendorList, createPlugin, src_default as default, emprivacyPlugin, isPolicyPagePath, isRootRelativeSitePath, isValidPolicyHrefInput, normalizeConfig, resolveEmbed, resolvePolicyHref };