@emplugins/emprivacy 2.1.0 → 3.1.0

package/dist/index.mjs

@@ -20,7 +20,8 @@ const CHROME = {
 		embedBlocked: "This embed is blocked until you allow the matching cookie category.",
 		embedNeedConsent: "To load this embed, allow the matching category in cookie settings.",
 		vendorsHeading: "What this site uses",
-		whatWeUse: "What we use"
+		whatWeUse: "What we use",
+		gpcNote: "Your browser sent Global Privacy Control, so marketing stays off."
 	},
 	de: {
 		acceptAll: "Alle akzeptieren",
@@ -40,7 +41,8 @@ const CHROME = {
 		embedBlocked: "Diese Einbettung ist gesperrt, bis Sie die passende Kategorie erlauben.",
 		embedNeedConsent: "Um diese Einbettung zu laden, erlauben Sie die passende Kategorie in den Cookie-Einstellungen.",
 		vendorsHeading: "Was diese Website verwendet",
-		whatWeUse: "Was wir verwenden"
+		whatWeUse: "Was wir verwenden",
+		gpcNote: "Ihr Browser sendet Global Privacy Control, daher bleibt Marketing deaktiviert."
 	},
 	fr: {
 		acceptAll: "Tout accepter",
@@ -60,7 +62,8 @@ const CHROME = {
 		embedBlocked: "Ce contenu est bloqué tant que vous n’avez pas autorisé la catégorie correspondante.",
 		embedNeedConsent: "Pour charger ce contenu, autorisez la catégorie correspondante dans les paramètres des cookies.",
 		vendorsHeading: "Ce que ce site utilise",
-		whatWeUse: "Ce que nous utilisons"
+		whatWeUse: "Ce que nous utilisons",
+		gpcNote: "Votre navigateur envoie Global Privacy Control, donc le marketing reste désactivé."
 	},
 	es: {
 		acceptAll: "Aceptar todo",
@@ -80,7 +83,8 @@ const CHROME = {
 		embedBlocked: "Este contenido está bloqueado hasta que permita la categoría correspondiente.",
 		embedNeedConsent: "Para cargar este contenido, permita la categoría correspondiente en los ajustes de cookies.",
 		vendorsHeading: "Qué usa este sitio",
-		whatWeUse: "Qué usamos"
+		whatWeUse: "Qué usamos",
+		gpcNote: "Su navegador envía Global Privacy Control, así que el marketing permanece desactivado."
 	},
 	it: {
 		acceptAll: "Accetta tutto",
@@ -100,7 +104,8 @@ const CHROME = {
 		embedBlocked: "Questo contenuto è bloccato finché non consenti la categoria corrispondente.",
 		embedNeedConsent: "Per caricare questo contenuto, consenti la categoria corrispondente nelle impostazioni cookie.",
 		vendorsHeading: "Cosa usa questo sito",
-		whatWeUse: "Cosa usiamo"
+		whatWeUse: "Cosa usiamo",
+		gpcNote: "Il browser invia Global Privacy Control, quindi il marketing resta disattivato."
 	},
 	nl: {
 		acceptAll: "Alles accepteren",
@@ -120,7 +125,8 @@ const CHROME = {
 		embedBlocked: "Deze embed is geblokkeerd tot u de bijbehorende categorie toestaat.",
 		embedNeedConsent: "Om deze embed te laden, sta de bijbehorende categorie toe in de cookie-instellingen.",
 		vendorsHeading: "Wat deze site gebruikt",
-		whatWeUse: "Wat wij gebruiken"
+		whatWeUse: "Wat wij gebruiken",
+		gpcNote: "Uw browser stuurt Global Privacy Control, dus marketing blijft uit."
 	},
 	pt: {
 		acceptAll: "Aceitar tudo",
@@ -140,7 +146,8 @@ const CHROME = {
 		embedBlocked: "Este conteúdo está bloqueado até autorizar a categoria correspondente.",
 		embedNeedConsent: "Para carregar este conteúdo, autorize a categoria correspondente nas definições de cookies.",
 		vendorsHeading: "O que este site usa",
-		whatWeUse: "O que usamos"
+		whatWeUse: "O que usamos",
+		gpcNote: "O seu navegador enviou Global Privacy Control, por isso o marketing permanece desligado."
 	},
 	pl: {
 		acceptAll: "Zaakceptuj wszystkie",
@@ -160,7 +167,8 @@ const CHROME = {
 		embedBlocked: "Ta treść jest zablokowana, dopóki nie zezwolisz na odpowiednią kategorię.",
 		embedNeedConsent: "Aby wczytać tę treść, zezwól na odpowiednią kategorię w ustawieniach plików cookie.",
 		vendorsHeading: "Czego używa ta witryna",
-		whatWeUse: "Czego używamy"
+		whatWeUse: "Czego używamy",
+		gpcNote: "Przeglądarka wysłała Global Privacy Control, więc marketing pozostaje wyłączony."
 	}
 };
 function isLocaleKey(s) {
@@ -235,6 +243,8 @@ const FATHOM_ID = /^[A-Za-z0-9]{4,32}$/;
 const UMAMI_ID = /^[A-Za-z0-9-]{8,64}$/;
 const GA4_ID = /^G-[A-Z0-9]{4,14}$/;
 const GTM_ID = /^GTM-[A-Z0-9]{4,12}$/;
+const CLARITY_ID = /^[a-z0-9]{7,20}$/i;
+const UET_ID = /^[0-9]{6,12}$/;
 function isHostname$1(s) {
 	const t = s.trim().toLowerCase();
 	if (!t || t.length > 253) return false;
@@ -253,6 +263,12 @@ function isFathomId(s) {
 function isUmamiId(s) {
 	return UMAMI_ID.test(s.trim());
 }
+function isClarityId(s) {
+	return CLARITY_ID.test(s.trim());
+}
+function isUetId(s) {
+	return UET_ID.test(s.trim());
+}
 //#endregion
 //#region src/security.ts
 /** Hosts EmPrivacy may load as <script src> for built-in presets. */
@@ -262,7 +278,10 @@ const PRESET_SCRIPT_HOSTS = /* @__PURE__ */ new Set([
 	"cdn.usefathom.com",
 	"scripts.simpleanalyticscdn.com",
 	"www.googletagmanager.com",
-	"googletagmanager.com"
+	"googletagmanager.com",
+	"www.clarity.ms",
+	"clarity.ms",
+	"bat.bing.com"
 ]);
 const HOSTNAME = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i;
 function normalizeCookieMaxAgeDays(n, fallback = 180) {
@@ -376,12 +395,81 @@ function rateHourKey(now = /* @__PURE__ */ new Date()) {
 //#region src/theme.ts
 /** Hex colors only — rejects CSS injection via theme fields. */
 const HEX = /^#(?:[0-9A-Fa-f]{3}|[0-9A-Fa-f]{6}|[0-9A-Fa-f]{8})$/;
+/** Fixed banner palettes. Colors are constants, never taken from the admin form. */
+const THEME_PROFILES = {
+	slate: {
+		bg: "#0f172a",
+		text: "#f8fafc",
+		accent: "#3b82f6",
+		radiusPx: 8
+	},
+	paper: {
+		bg: "#f7f6f3",
+		text: "#37352f",
+		accent: "#1d4ed8",
+		radiusPx: 6
+	},
+	ink: {
+		bg: "#000000",
+		text: "#ededed",
+		accent: "#0070f3",
+		radiusPx: 8
+	},
+	indigo: {
+		bg: "#ffffff",
+		text: "#0f172a",
+		accent: "#4f46e5",
+		radiusPx: 12
+	},
+	primer: {
+		bg: "#f6f8fa",
+		text: "#1f2328",
+		accent: "#0969da",
+		radiusPx: 6
+	}
+};
+const THEME_PROFILE_IDS = [
+	"slate",
+	"paper",
+	"ink",
+	"indigo",
+	"primer"
+];
+/** First profile. New installs and configs with no theme choice use this. */
+const DEFAULT_THEME_PROFILE = THEME_PROFILE_IDS[0];
 const DEFAULT_THEME = {
-	bg: "#111111",
-	text: "#eeeeee",
-	accent: "#3b82f6",
-	radiusPx: 6
+	bg: THEME_PROFILES[DEFAULT_THEME_PROFILE].bg,
+	text: THEME_PROFILES[DEFAULT_THEME_PROFILE].text,
+	accent: THEME_PROFILES[DEFAULT_THEME_PROFILE].accent,
+	radiusPx: THEME_PROFILES[DEFAULT_THEME_PROFILE].radiusPx
 };
+function isThemeProfileId(value) {
+	return THEME_PROFILE_IDS.includes(value);
+}
+/** Stored JSON: a missing or unknown choice uses the first profile. Explicit `custom` is kept. */
+function normalizeThemeChoice(value) {
+	if (value === "custom") return "custom";
+	if (typeof value === "string" && isThemeProfileId(value)) return value;
+	return DEFAULT_THEME_PROFILE;
+}
+/** Admin save: blank uses the first profile. `custom` is the manual option. */
+function parseThemeChoice(value) {
+	const t = value.trim().toLowerCase();
+	if (!t) return DEFAULT_THEME_PROFILE;
+	if (t === "custom") return "custom";
+	if (isThemeProfileId(t)) return t;
+	throw new Error("Banner theme must be Custom, Slate, Paper, Ink, Indigo, or Primer.");
+}
+function themeForChoice(choice, custom) {
+	if (choice === "custom") return custom;
+	const profile = THEME_PROFILES[choice];
+	return {
+		bg: profile.bg,
+		text: profile.text,
+		accent: profile.accent,
+		radiusPx: profile.radiusPx
+	};
+}
 function isSafeHexColor(s) {
 	return HEX.test(s.trim());
 }
@@ -430,8 +518,10 @@ const DEFAULT_CONFIG = {
 	embedCategory: "marketing",
 	gateEmbeds: true,
 	hideBannerOnPolicyPages: true,
+	bannerPosition: "bottom",
 	defaultLocale: "en",
 	localeOverrides: {},
+	themeProfile: "slate",
 	theme: { ...DEFAULT_THEME }
 };
 const ANALYTICS_PROVIDERS = [
@@ -443,8 +533,13 @@ const ANALYTICS_PROVIDERS = [
 	"umami",
 	"simpleanalytics",
 	"ga4",
-	"gtm"
+	"gtm",
+	"clarity",
+	"uet"
 ];
+function normalizeBannerPosition(value) {
+	return value === "top" ? "top" : "bottom";
+}
 function hasUnsafeUrlChars(s) {
 	return /[\u0000-\u001F\u007F\s]/.test(s);
 }
@@ -582,14 +677,16 @@ function normalizeConfig(raw) {
 		embedCategory: isEmbedCategory(embedRaw) ? embedRaw : DEFAULT_CONFIG.embedCategory,
 		gateEmbeds: typeof o.gateEmbeds === "boolean" ? o.gateEmbeds : DEFAULT_CONFIG.gateEmbeds,
 		hideBannerOnPolicyPages: typeof o.hideBannerOnPolicyPages === "boolean" ? o.hideBannerOnPolicyPages : DEFAULT_CONFIG.hideBannerOnPolicyPages,
+		bannerPosition: normalizeBannerPosition(o.bannerPosition),
 		defaultLocale: typeof o.defaultLocale === "string" && o.defaultLocale ? o.defaultLocale : DEFAULT_CONFIG.defaultLocale,
 		localeOverrides: parseLocaleOverrides(o.localeOverrides),
-		theme: {
+		themeProfile: normalizeThemeChoice(o.themeProfile),
+		theme: themeForChoice(normalizeThemeChoice(o.themeProfile), {
 			bg: normalizeHexColor(typeof themeRaw.bg === "string" ? themeRaw.bg : "", DEFAULT_THEME.bg),
 			text: normalizeHexColor(typeof themeRaw.text === "string" ? themeRaw.text : "", DEFAULT_THEME.text),
 			accent: normalizeHexColor(typeof themeRaw.accent === "string" ? themeRaw.accent : "", DEFAULT_THEME.accent),
 			radiusPx: normalizeRadiusPx(themeRaw.radiusPx, DEFAULT_THEME.radiusPx)
-		}
+		})
 	};
 }
 function assertAnalyticsId(provider, id, umamiScriptUrl) {
@@ -615,6 +712,14 @@ function assertAnalyticsId(provider, id, umamiScriptUrl) {
 		if (!isGtmId(t)) throw new Error("Google Tag Manager ID must look like GTM-XXXX.");
 		return;
 	}
+	if (provider === "clarity") {
+		if (!isClarityId(t)) throw new Error("Clarity project ID must be 7–20 letters or digits.");
+		return;
+	}
+	if (provider === "uet") {
+		if (!isUetId(t)) throw new Error("UET tag ID must be 6–12 digits.");
+		return;
+	}
 	if (provider === "simpleanalytics" && t && !isHostname$1(t)) throw new Error("Simple Analytics hostname must be a domain like example.com, or empty.");
 }
 /** Validate admin-submitted fields; throws an Error with a short message on failure */
@@ -673,17 +778,22 @@ function assertValidSavedConfig(input) {
 	if (!isEmbedCategory(embedCategory)) throw new Error("Embeds must require Functional or Marketing consent.");
 	const defaultLocale = input.defaultLocale.trim().toLowerCase() || "en";
 	if (!/^[a-z]{2,3}(?:-[a-z]{2})?$/.test(defaultLocale)) throw new Error("Default locale must look like en or pt-BR.");
+	const bannerPosition = input.bannerPosition.trim().toLowerCase();
+	if (bannerPosition !== "top" && bannerPosition !== "bottom") throw new Error("Banner position must be top or bottom.");
 	const localeOverrides = parseLocaleOverridesText(input.localeOverridesText);
 	for (const pack of Object.values(localeOverrides)) {
 		if (pack.bannerTitle !== void 0) assertOptionalLength("Translated banner title", pack.bannerTitle, 120);
 		if (pack.bannerMessage !== void 0) assertOptionalLength("Translated short notice", pack.bannerMessage, 600);
 	}
+	const themeProfile = parseThemeChoice(input.themeProfile);
 	const themeBg = input.themeBg.trim() || DEFAULT_THEME.bg;
 	const themeText = input.themeText.trim() || DEFAULT_THEME.text;
 	const themeAccent = input.themeAccent.trim() || DEFAULT_THEME.accent;
-	if (input.themeBg.trim() && !/^#(?:[0-9A-Fa-f]{3}|[0-9A-Fa-f]{6}|[0-9A-Fa-f]{8})$/.test(themeBg)) throw new Error("Banner background must be a hex color like #111111.");
-	if (input.themeText.trim() && !/^#(?:[0-9A-Fa-f]{3}|[0-9A-Fa-f]{6}|[0-9A-Fa-f]{8})$/.test(themeText)) throw new Error("Banner text color must be a hex color like #eeeeee.");
-	if (input.themeAccent.trim() && !/^#(?:[0-9A-Fa-f]{3}|[0-9A-Fa-f]{6}|[0-9A-Fa-f]{8})$/.test(themeAccent)) throw new Error("Banner accent color must be a hex color like #3b82f6.");
+	if (themeProfile === "custom") {
+		if (input.themeBg.trim() && !/^#(?:[0-9A-Fa-f]{3}|[0-9A-Fa-f]{6}|[0-9A-Fa-f]{8})$/.test(themeBg)) throw new Error("Banner background must be a hex color like #111111.");
+		if (input.themeText.trim() && !/^#(?:[0-9A-Fa-f]{3}|[0-9A-Fa-f]{6}|[0-9A-Fa-f]{8})$/.test(themeText)) throw new Error("Banner text color must be a hex color like #eeeeee.");
+		if (input.themeAccent.trim() && !/^#(?:[0-9A-Fa-f]{3}|[0-9A-Fa-f]{6}|[0-9A-Fa-f]{8})$/.test(themeAccent)) throw new Error("Banner accent color must be a hex color like #3b82f6.");
+	}
 	return normalizeConfig({
 		bannerTitle: input.bannerTitle.trim() || DEFAULT_CONFIG.bannerTitle,
 		bannerMessage: input.bannerMessage.trim() || DEFAULT_CONFIG.bannerMessage,
@@ -705,14 +815,16 @@ function assertValidSavedConfig(input) {
 		embedCategory,
 		gateEmbeds: input.gateEmbeds,
 		hideBannerOnPolicyPages: input.hideBannerOnPolicyPages,
+		bannerPosition,
 		defaultLocale,
 		localeOverrides,
-		theme: {
+		themeProfile,
+		theme: themeForChoice(themeProfile, themeProfile === "custom" ? {
 			bg: themeBg,
 			text: themeText,
 			accent: themeAccent,
 			radiusPx: parseRadiusInput(input.themeRadius, DEFAULT_THEME.radiusPx)
-		}
+		} : { ...DEFAULT_THEME })
 	});
 }
 /** Safe to embed in `<script type="application/json">` (breakout-safe) */
@@ -830,17 +942,80 @@ async function fetchLatestPublishedVersion(options) {
 	}
 }
 //#endregion
+//#region src/consent-csv.ts
+const FORMULA_PREFIX = /^[\t\r ]*[=+\-@]/;
+/** Quote a cell and neutralize spreadsheet formula injection. */
+function csvCell(value) {
+	let s = value.replace(/\r\n|\n|\r/g, " ");
+	if (FORMULA_PREFIX.test(s)) s = `'${s}`;
+	return `"${s.replace(/"/g, "\"\"")}"`;
+}
+function boolCell(value) {
+	return value === true ? "true" : value === false ? "false" : "";
+}
+function buildConsentCsv(rows) {
+	const lines = [[
+		"createdAt",
+		"policyVersion",
+		"functional",
+		"analytics",
+		"marketing",
+		"gpc"
+	].map(csvCell).join(",")];
+	for (const row of rows) lines.push([
+		csvCell(typeof row.createdAt === "string" ? row.createdAt : ""),
+		csvCell(typeof row.policyVersion === "string" ? row.policyVersion : ""),
+		csvCell(boolCell(row.functional)),
+		csvCell(boolCell(row.analytics)),
+		csvCell(boolCell(row.marketing)),
+		csvCell(row.gpc === true ? "true" : "")
+	].join(","));
+	return `\uFEFF${lines.join("\r\n")}\r\n`;
+}
+//#endregion
+//#region src/cookie-purge.ts
+const ANALYTICS_COOKIE_EXACT = [
+	"_ga",
+	"_gid",
+	"_gat"
+];
+const ANALYTICS_COOKIE_PREFIX = ["_ga_", "_gat_"];
+const MARKETING_COOKIE_EXACT = [
+	"_gcl_au",
+	"_gcl_aw",
+	"_gcl_dc",
+	"_clck",
+	"_clsk",
+	"CLID",
+	"_uetsid",
+	"_uetvid"
+];
+const MARKETING_COOKIE_PREFIX = ["_gcl_"];
+const PURGE_RULES = {
+	analytics: {
+		exact: [...ANALYTICS_COOKIE_EXACT],
+		prefix: [...ANALYTICS_COOKIE_PREFIX]
+	},
+	marketing: {
+		exact: [...MARKETING_COOKIE_EXACT],
+		prefix: [...MARKETING_COOKIE_PREFIX]
+	}
+};
+//#endregion
 //#region src/public-bootstrap.ts
 /**
 * Public-site bootstrap. Banner copy is applied with textContent / createTextNode only.
 * Embed/script URLs are re-validated in the browser (never trust DOM data-src alone).
 */
 function buildBodyBootstrap(pr) {
+	const jsonLiteral = jsonForHtmlScript(pr);
+	const purgeLiteral = jsonForHtmlScript(PURGE_RULES);
 	return `(function(){
-var C=${jsonForHtmlScript(pr)};
+var C=${jsonLiteral};
 var CN="${COOKIE_NAME}";
+var PURGE=${purgeLiteral};
 var listeners=[];
-var PRESET_HOSTS={"static.cloudflareinsights.com":1,"plausible.io":1,"cdn.usefathom.com":1,"scripts.simpleanalyticscdn.com":1,"www.googletagmanager.com":1,"googletagmanager.com":1};
+var PRESET_HOSTS={"static.cloudflareinsights.com":1,"plausible.io":1,"cdn.usefathom.com":1,"scripts.simpleanalyticscdn.com":1,"www.googletagmanager.com":1,"googletagmanager.com":1,"www.clarity.ms":1,"clarity.ms":1,"bat.bing.com":1};
 var YT_IFRAME=/^https:\\/\\/(?:www\\.)?youtube-nocookie\\.com\\/embed\\/[A-Za-z0-9_-]{11}\\/?$/;
 var VIMEO_IFRAME=/^https:\\/\\/player\\.vimeo\\.com\\/video\\/\\d{6,12}\\/?$/;
 function readCookie(){
@@ -867,7 +1042,64 @@ if(!flagOk(o.a)||!flagOk(o.m)||!flagOk(o.f))return null;
 return {v:o.v,essential:true,functional:!!o.f,analytics:!!o.a,marketing:!!o.m};
 }catch(e){return null;}
 }
-function currentState(){return parseState(readCookie());}
+function gpcOn(){
+try{return navigator.globalPrivacyControl===true;}catch(e){return false;}
+}
+function effective(st){
+if(!st)return null;
+var g=gpcOn();
+return {v:st.v,essential:true,functional:!!st.functional,analytics:!!st.analytics,marketing:g?false:!!st.marketing,gpc:g};
+}
+function currentState(){return effective(parseState(readCookie()));}
+function cookieNameOk(name){return /^[A-Za-z0-9_]{1,64}$/.test(name);}
+function expireCookie(name){
+if(!cookieNameOk(name)||name===CN)return;
+var secure=document.location.protocol==="https:"?"; Secure":"";
+var base=name+"=; Max-Age=0; Path=/; SameSite=Lax"+secure;
+document.cookie=base;
+var host=String(document.location.hostname||"");
+if(!/^[A-Za-z0-9.-]{1,253}$/.test(host)||host.indexOf("..")>=0)return;
+var hosts=[host];
+var labels=host.split(".");
+if(labels.length>=3)hosts.push(labels.slice(1).join("."));
+for(var i=0;i<hosts.length;i++){
+var h=hosts[i];
+if(!/^[A-Za-z0-9.-]{1,253}$/.test(h))continue;
+document.cookie=base+"; Domain="+h;
+document.cookie=base+"; Domain=."+h;
+}
+}
+function purgeSet(exact,prefixes){
+var raw="";
+try{raw=document.cookie;}catch(e){return;}
+if(!raw)return;
+if(raw.length>8192)raw=raw.slice(0,8192);
+raw.split(";").forEach(function(part){
+var name=(part.split("=")[0]||"").replace(/^\\s+/,"");
+if(!cookieNameOk(name)||name===CN)return;
+var hit=exact.indexOf(name)>=0;
+if(!hit){
+for(var i=0;i<prefixes.length;i++){
+if(prefixes[i]&&name.indexOf(prefixes[i])===0){hit=true;break;}
+}
+}
+if(hit)expireCookie(name);
+});
+}
+function purgeDenied(st){
+var rules=PURGE||{};
+if(!st.analytics){
+var a=rules.analytics||{};
+purgeSet(a.exact||[],a.prefix||[]);
+}
+if(!st.marketing){
+var m=rules.marketing||{};
+purgeSet(m.exact||[],m.prefix||[]);
+}
+}
+function deniedState(){
+return {v:"",essential:true,functional:false,analytics:false,marketing:false,gpc:gpcOn()};
+}
 function emit(st){
 listeners.slice().forEach(function(fn){try{fn(st);}catch(e){}});
 try{document.dispatchEvent(new CustomEvent("emprivacy:change",{detail:st}));}catch(e){}
@@ -951,7 +1183,7 @@ e.setAttribute("data-cf-beacon",JSON.stringify({token:token}));
 e.referrerPolicy="no-referrer-when-downgrade";
 document.head.appendChild(e);
 }
-function applyAnalytics(){
+function applyAnalytics(st){
 var L=C.loader||{type:"none"};
 if(L.type==="cloudflare") loadCloudflareBeacon(L.token);
 else if(L.type==="custom") (L.scripts||[]).forEach(function(s){loadScript(s.src,null,s.integrity,false);});
@@ -966,6 +1198,13 @@ loadScript("https://www.googletagmanager.com/gtag/js?id="+encodeURIComponent(L.m
 window.gtag("js",new Date());
 window.gtag("config",L.measurementId);
 }
+else if(L.type==="clarity"){
+var id=String(L.projectId||"");
+if(!/^[a-z0-9]{7,20}$/i.test(id))return;
+window.clarity=window.clarity||function(){(window.clarity.q=window.clarity.q||[]).push(arguments);};
+window.clarity("consentv2",{ad_Storage:st.marketing?"granted":"denied",analytics_Storage:"granted"});
+loadScript("https://www.clarity.ms/tag/"+encodeURIComponent(id),null,null,true);
+}
 }
 function applyMarketing(){
 var urls=C.marketingScripts||[];
@@ -976,10 +1215,31 @@ window.dataLayer=window.dataLayer||[];
 window.dataLayer.push({"gtm.start":Date.now(),event:"gtm.js"});
 loadScript("https://www.googletagmanager.com/gtm.js?id="+encodeURIComponent(L.containerId),null,null,true);
 }
+else if(L.type==="uet"){
+var id=String(L.tagId||"");
+if(!/^[0-9]{6,12}$/.test(id))return;
+window.uetq=window.uetq||[];
+window.uetq.push("consent","update",{"ad_storage":"granted"});
+var src="https://bat.bing.com/bat.js";
+if(alreadyScriptSrc(src))return;
+var n=document.createElement("script");
+n.src=src;
+n.async=true;
+n.onload=function(){
+try{
+var q=window.uetq;
+window.uetq=new window.UET({ti:id,enableAutoSpaTracking:false,q:q});
+window.uetq.push("pageLoad");
+}catch(e){}
+};
+document.head.appendChild(n);
+}
 }
 function applyScripts(st){
-if(st.analytics) applyAnalytics();
-if(st.marketing) applyMarketing();
+var eff=effective(st)||st;
+purgeDenied(eff);
+if(eff.analytics) applyAnalytics(eff);
+if(eff.marketing) applyMarketing();
 }
 function gtagUpdate(st){
 if(!C.googleConsentMode||!window.gtag)return;
@@ -999,7 +1259,7 @@ fetch(C.recordPath,{
 method:"POST",
 credentials:"same-origin",
 headers:{"Content-Type":"application/json"},
-body:JSON.stringify({policyVersion:C.policyVersion,functional:!!st.functional,analytics:!!st.analytics,marketing:!!st.marketing})
+body:JSON.stringify({policyVersion:C.policyVersion,functional:!!st.functional,analytics:!!st.analytics,marketing:!!st.marketing,gpc:!!st.gpc})
 }).catch(function(){});
 }
 function hide(el){if(el)el.setAttribute("hidden","");el&&(el.style.display="none");}
@@ -1049,7 +1309,8 @@ else mountLink(box,src,box.getAttribute("data-label")||"",kind);
 });
 }
 function persist(a,m,f,opts){
-var st={v:C.policyVersion,essential:true,functional:!!f,analytics:!!a,marketing:!!m};
+if(gpcOn())m=false;
+var st={v:C.policyVersion,essential:true,functional:!!f,analytics:!!a,marketing:!!m,gpc:gpcOn()};
 writeCookie(JSON.stringify({v:st.v,a:st.analytics?1:0,m:st.marketing?1:0,f:st.functional?1:0}));
 logServer(st);
 gtagUpdate(st);
@@ -1163,18 +1424,52 @@ ic.appendChild(document.createTextNode("🍪"));
 trigger.appendChild(ic);
 function showTrigger(){trigger.removeAttribute("hidden");}
 function hideTrigger(){trigger.setAttribute("hidden","");}
+function focusables(bar){
+return Array.prototype.filter.call(bar.querySelectorAll("a[href],button:not([disabled]),input:not([disabled]),summary"),function(el){
+return !el.closest("[hidden]");
+});
+}
+function bindDialog(bar,isReopen){
+bar.tabIndex=-1;
+function closeReopen(){
+if(bar.parentNode)bar.parentNode.removeChild(bar);
+showTrigger();
+try{trigger.focus();}catch(e){}
+}
+bar.addEventListener("keydown",function(ev){
+if(ev.key==="Escape"){
+if(!isReopen)return;
+ev.preventDefault();
+closeReopen();
+return;
+}
+if(ev.key!=="Tab")return;
+var nodes=focusables(bar);
+if(!nodes.length){ev.preventDefault();return;}
+var first=nodes[0],last=nodes[nodes.length-1],active=document.activeElement;
+if(ev.shiftKey){
+if(active===first||active===bar){ev.preventDefault();last.focus();}
+}else if(active===last){
+ev.preventDefault();first.focus();
+}
+});
+if(isReopen) bar.__emprivacyClose=closeReopen;
+try{bar.focus();}catch(e){}
+}
 function buildPanel(isReopen,hint){
 var st=parseState(readCookie());
 var aOn=st?!!st.analytics:(C.strictDefaults?false:true);
-var mOn=st?!!st.marketing:(C.strictDefaults?false:true);
+var mOn=gpcOn()?false:(st?!!st.marketing:(C.strictDefaults?false:true));
 var fOn=st?!!st.functional:(C.strictDefaults?false:true);
 if(isReopen) hideTrigger();
 var bar=document.createElement("div");
-bar.className="emprivacy-bar"+(isReopen?" emprivacy-bar--reopen":"");
+bar.className="emprivacy-bar"+(C.bannerPosition==="top"?" emprivacy-bar--top":"")+(isReopen?" emprivacy-bar--reopen":"");
 bar.setAttribute("role","dialog");
 bar.setAttribute("aria-modal",isReopen?"true":"false");
 var title=document.createElement("h2");
+title.id=isReopen?"emprivacy-reopen-title":"emprivacy-banner-title";
 title.className="emprivacy-title";
+bar.setAttribute("aria-labelledby",title.id);
 title.appendChild(document.createTextNode(C.bannerTitle));
 var msg=document.createElement("p");
 msg.className="emprivacy-msg";
@@ -1199,6 +1494,7 @@ note.appendChild(document.createTextNode(C.ui.essentialNote));
 var fr=mkRow(C.ui.functional,isReopen?"emprivacy-rf":"emprivacy-f",fOn,false);
 var er=mkRow(C.ui.analytics,isReopen?"emprivacy-ra":"emprivacy-a",aOn,false);
 var mr=mkRow(C.ui.marketing,isReopen?"emprivacy-rm":"emprivacy-m",mOn,false);
+if(gpcOn()){mr.box.checked=false;mr.box.disabled=true;}
 opts.appendChild(ess.wrap);
 opts.appendChild(note);
 opts.appendChild(fr.wrap);
@@ -1238,14 +1534,21 @@ btnClose.type="button";
 btnClose.className="emprivacy-btn";
 btnClose.appendChild(document.createTextNode(C.ui.close));
 btnClose.addEventListener("click",function(){
-if(bar.parentNode)bar.parentNode.removeChild(bar);
-showTrigger();
+if(typeof bar.__emprivacyClose==="function")bar.__emprivacyClose();
 });
 actions.appendChild(btnClose);
 }
 actions.appendChild(btnSave);
 bar.appendChild(title);
 bar.appendChild(msg);
+if(gpcOn()){
+var gpcEl=document.createElement("p");
+gpcEl.className="emprivacy-note";
+gpcEl.id=isReopen?"emprivacy-gpc-reopen":"emprivacy-gpc-note";
+gpcEl.appendChild(document.createTextNode(C.ui.gpcNote||""));
+bar.appendChild(gpcEl);
+bar.setAttribute("aria-describedby",gpcEl.id);
+}
 bar.appendChild(links);
 bar.appendChild(opts);
 bar.appendChild(actions);
@@ -1255,7 +1558,9 @@ function openReopenPanel(hint){
 if(root.querySelector(".emprivacy-bar--reopen"))return;
 var st=parseState(readCookie());
 if(!st)return;
-root.appendChild(buildPanel(true,hint||""));
+var panel=buildPanel(true,hint||"");
+root.appendChild(panel);
+bindDialog(panel,true);
 }
 openPanel=function(hint){
 var st=parseState(readCookie());
@@ -1270,7 +1575,7 @@ note.appendChild(document.createTextNode(hint));
 var opts=existing.querySelector(".emprivacy-opts");
 if(opts){opts.insertBefore(note,opts.firstChild);show(opts);}
 }
-try{existing.scrollIntoView({block:"end"});}catch(e){}
+try{existing.scrollIntoView({block:C.bannerPosition==="top"?"start":"end"});}catch(e){}
 }
 }
 };
@@ -1294,18 +1599,21 @@ openPanel(C.ui.embedNeedConsent);
 }
 wireEmbedButtons();
 if(!needBanner()){
-var st=parseState(readCookie());
+var st=currentState();
 if(st){
 applyScripts(st);
 gtagUpdate(st);
 hydrateEmbeds(st);
-}
+}else purgeDenied(deniedState());
 showTrigger();
 trigger.addEventListener("click",function(){openReopenPanel();});
 installApi();
 return;
 }
-root.appendChild(buildPanel(false,""));
+purgeDenied(deniedState());
+var first=buildPanel(false,"");
+root.appendChild(first);
+bindDialog(first,false);
 trigger.addEventListener("click",function(){openReopenPanel();});
 installApi();
 }
@@ -1316,6 +1624,11 @@ else mount();
 function buildGoogleConsentHeadScript() {
 	return `(function(){window.dataLayer=window.dataLayer||[];function g(){window.dataLayer.push(arguments);}window.gtag=g;g("consent","default",{"analytics_storage":"denied","ad_storage":"denied","ad_user_data":"denied","ad_personalization":"denied","functionality_storage":"denied","security_storage":"granted","personalization_storage":"denied"});})();`;
 }
+/** Denied-by-default Microsoft signals. The tag itself loads only after the matching category is allowed. */
+function buildMicrosoftConsentHeadScript(kind) {
+	if (kind === "clarity") return `(function(){window.clarity=window.clarity||function(){(window.clarity.q=window.clarity.q||[]).push(arguments);};window.clarity("consentv2",{"ad_Storage":"denied","analytics_Storage":"denied"});})();`;
+	return `(function(){window.uetq=window.uetq||[];window.uetq.push("consent","default",{"ad_storage":"denied"});})();`;
+}
 //#endregion
 //#region src/vendors.ts
 const PLAUSIBLE_SCRIPT = "https://plausible.io/js/script.js";
@@ -1362,6 +1675,14 @@ function buildAnalyticsLoader(cfg) {
 			type: "gtm",
 			containerId: cfg.analyticsId.trim()
 		} : { type: "none" };
+		case "clarity": return isClarityId(cfg.analyticsId) ? {
+			type: "clarity",
+			projectId: cfg.analyticsId.trim()
+		} : { type: "none" };
+		case "uet": return isUetId(cfg.analyticsId) ? {
+			type: "uet",
+			tagId: cfg.analyticsId.trim()
+		} : { type: "none" };
 		default: return { type: "none" };
 	}
 }
@@ -1428,6 +1749,20 @@ function buildVendorList(cfg) {
 		purpose: "Loads GTM only after Marketing consent (containers often fire ads/remarketing). You remain responsible for tags inside the container.",
 		policyUrl: "https://policies.google.com/privacy"
 	});
+	else if (loader.type === "clarity") rows.push({
+		id: "clarity",
+		name: "Microsoft Clarity",
+		category: "analytics",
+		purpose: "Clarity loads only after Analytics consent. Advertising storage stays denied until Marketing is also allowed. The project ID is not shown here.",
+		policyUrl: "https://www.microsoft.com/privacy"
+	});
+	else if (loader.type === "uet") rows.push({
+		id: "uet",
+		name: "Microsoft Advertising (UET)",
+		category: "marketing",
+		purpose: "The UET tag loads only after Marketing consent. Until then, advertising storage stays denied and the tag is not injected.",
+		policyUrl: "https://www.microsoft.com/privacy"
+	});
 	else if (loader.type === "custom") for (const [i, script] of loader.scripts.entries()) {
 		let host = "custom script";
 		try {
@@ -1463,7 +1798,7 @@ function buildVendorList(cfg) {
 }
 //#endregion
 //#region src/version.ts
-const VERSION = "2.1.0";
+const VERSION = "3.1.0";
 //#endregion
 //#region src/runtime.ts
 /** Soft cap for anonymous consent POSTs per client fingerprint per UTC hour. */
@@ -1475,8 +1810,10 @@ const recordInput = z.object({
 	policyVersion: z.string().trim().min(1).max(64),
 	functional: z.boolean(),
 	analytics: z.boolean(),
-	marketing: z.boolean()
+	marketing: z.boolean(),
+	gpc: z.boolean().optional()
 });
+const EXPORT_PATH = `/_emdash/api/plugins/${PLUGIN_ID}/consent-export`;
 async function loadConfig(ctx) {
 	const raw = await ctx.kv.get(KV_KEY);
 	if (!raw) return normalizeConfig({});
@@ -1541,6 +1878,7 @@ function publicRuntime(cfg, ctx, page) {
 		embedCategory: cfg.embedCategory,
 		gateEmbeds: cfg.gateEmbeds,
 		hideBanner,
+		bannerPosition: cfg.bannerPosition,
 		theme: cfg.theme,
 		ui: copy.ui,
 		loader: buildAnalyticsLoader(cfg),
@@ -1556,8 +1894,9 @@ function publicRuntime(cfg, ctx, page) {
 }
 function themeStyle() {
 	return `<style id="emprivacy-style">
-#emprivacy-root{font-family:system-ui,sans-serif;font-size:14px;--emprivacy-bg:#111111;--emprivacy-text:#eeeeee;--emprivacy-accent:#3b82f6;--emprivacy-radius:6px}
-.emprivacy-bar{position:fixed;z-index:99999;left:0;right:0;bottom:0;background:var(--emprivacy-bg);color:var(--emprivacy-text);padding:16px 20px 20px;box-shadow:0 -4px 24px rgba(0,0,0,.25);max-height:45vh;overflow:auto}
+#emprivacy-root{font-family:system-ui,sans-serif;font-size:14px;--emprivacy-bg:#0f172a;--emprivacy-text:#f8fafc;--emprivacy-accent:#3b82f6;--emprivacy-radius:8px}
+.emprivacy-bar{position:fixed;z-index:99999;inset-inline:0;bottom:0;background:var(--emprivacy-bg);color:var(--emprivacy-text);padding:16px 20px max(20px, env(safe-area-inset-bottom));box-shadow:0 -4px 24px rgba(0,0,0,.25);max-height:min(45vh, 100dvh);overflow:auto}
+.emprivacy-bar--top{top:0;bottom:auto;padding:max(16px, env(safe-area-inset-top)) 20px 16px;box-shadow:0 4px 24px rgba(0,0,0,.25)}
 .emprivacy-title{margin:0 0 8px;font-size:1.1rem}
 .emprivacy-msg,.emprivacy-note{margin:0 0 10px;line-height:1.4;opacity:.95}
 .emprivacy-note{font-size:.85rem}
@@ -1566,6 +1905,8 @@ function themeStyle() {
 .emprivacy-switch{display:block;margin:6px 0}
 .emprivacy-actions{display:flex;flex-wrap:wrap;gap:8px;margin-top:10px}
 .emprivacy-btn{border-radius:var(--emprivacy-radius);border:1px solid color-mix(in srgb,var(--emprivacy-text) 35%,transparent);background:transparent;color:var(--emprivacy-text);padding:8px 12px;cursor:pointer}
+.emprivacy-btn:focus-visible,.emprivacy-switch input:focus-visible,.emprivacy-links a:focus-visible,.emprivacy-vendors summary:focus-visible,.emprivacy-bar:focus-visible{outline:2px solid var(--emprivacy-accent);outline-offset:2px}
+.emprivacy-btn-primary:focus-visible{outline-color:#fff}
 .emprivacy-btn-primary{background:var(--emprivacy-accent);border-color:var(--emprivacy-accent);color:#fff}
 .emprivacy-cookie-trigger{position:fixed;z-index:99998;left:16px;bottom:16px;width:48px;height:48px;border-radius:50%;border:1px solid color-mix(in srgb,var(--emprivacy-text) 35%,transparent);background:var(--emprivacy-bg);color:var(--emprivacy-text);box-shadow:0 2px 12px rgba(0,0,0,.2);cursor:pointer;padding:0;display:flex;align-items:center;justify-content:center}
 .emprivacy-cookie-trigger:hover{filter:brightness(1.1)}
@@ -1636,6 +1977,12 @@ function createPlugin() {
 					key: "emprivacy:gcm-default",
 					code: buildGoogleConsentHeadScript()
 				});
+				if (cfg.analyticsProvider === "clarity" || cfg.analyticsProvider === "uet") headScripts.push({
+					kind: "inline-script",
+					placement: "head",
+					key: "emprivacy:ms-consent-default",
+					code: buildMicrosoftConsentHeadScript(cfg.analyticsProvider)
+				});
 				const boot = {
 					kind: "inline-script",
 					placement: "body:end",
@@ -1683,6 +2030,8 @@ function createPlugin() {
 							embedCategory: String(v.embed_category ?? "marketing"),
 							gateEmbeds: asBool(v.gate_embeds),
 							hideBannerOnPolicyPages: asBool(v.hide_on_policy),
+							bannerPosition: String(v.banner_position ?? "bottom"),
+							themeProfile: String(v.theme_profile ?? "slate"),
 							defaultLocale: String(v.default_locale ?? "en"),
 							localeOverridesText: String(v.locale_overrides ?? ""),
 							themeBg: String(v.theme_bg ?? ""),
@@ -1733,12 +2082,14 @@ function createPlugin() {
 					const input = ctx.input;
 					if (input.policyVersion !== cfg.policyVersion) return new Response("policy_version_mismatch", { status: 400 });
 					if (!await allowRecordWrite(ctx, ctx.request)) return new Response("rate_limited", { status: 429 });
+					const gpc = input.gpc === true;
 					const row = {
 						createdAt: (/* @__PURE__ */ new Date()).toISOString(),
 						policyVersion: input.policyVersion,
 						functional: input.functional,
 						analytics: input.analytics,
-						marketing: input.marketing
+						marketing: gpc ? false : input.marketing,
+						...gpc ? { gpc: true } : {}
 					};
 					try {
 						if ((await ctx.storage.consentEvents.query({
@@ -1758,6 +2109,29 @@ function createPlugin() {
 					return { ok: true };
 				}
 			},
+			"consent-export": { handler: async (ctx) => {
+				if (ctx.request.method !== "GET") return new Response("method_not_allowed", { status: 405 });
+				if (!ctx.user) return new Response("unauthorized", { status: 401 });
+				let rows = [];
+				try {
+					rows = (await ctx.storage.consentEvents.query({
+						orderBy: { createdAt: "desc" },
+						limit: RECORD_LOG_CAP
+					})).items.map((item) => item.data);
+				} catch {
+					return new Response("export_unavailable", { status: 503 });
+				}
+				const body = buildConsentCsv(rows);
+				return new Response(body, {
+					status: 200,
+					headers: {
+						"Content-Type": "text/csv; charset=utf-8",
+						"Content-Disposition": "attachment; filename=\"emprivacy-consent.csv\"",
+						"Cache-Control": "private, no-store",
+						"X-Content-Type-Options": "nosniff"
+					}
+				});
+			} },
 			vendors: {
 				public: true,
 				handler: async (ctx) => {
@@ -1770,7 +2144,7 @@ function createPlugin() {
 }
 async function buildSettingsPage(ctx) {
 	const [cfg, latestPublished] = await Promise.all([loadConfig(ctx), fetchLatestPublishedVersion({ fetch: ctx.http?.fetch ?? globalThis.fetch })]);
-	const installedVersion = ctx.plugin?.version ?? "2.1.0";
+	const installedVersion = ctx.plugin?.version ?? "3.1.0";
 	const analyticsText = cfg.analyticsScriptUrls.map((src) => {
 		const i = cfg.scriptIntegrity[src];
 		return i ? `${src} ${i}` : src;
@@ -1794,9 +2168,10 @@ async function buildSettingsPage(ctx) {
 			})).items.map((item) => {
 				const d = item.data;
 				const functional = typeof d.functional === "boolean" ? ` · functional ${d.functional ? "on" : "off"}` : "";
+				const gpc = d.gpc === true ? " · GPC" : "";
 				return {
 					label: d.createdAt,
-					value: `policy ${d.policyVersion}${functional} · analytics ${d.analytics ? "on" : "off"} · marketing ${d.marketing ? "on" : "off"}`
+					value: `policy ${d.policyVersion}${functional} · analytics ${d.analytics ? "on" : "off"} · marketing ${d.marketing ? "on" : "off"}${gpc}`
 				};
 			});
 		} catch {
@@ -1893,6 +2268,19 @@ async function buildSettingsPage(ctx) {
 					label: "Hide the first-visit banner on privacy and cookie policy pages",
 					initial_value: cfg.hideBannerOnPolicyPages
 				},
+				{
+					type: "radio",
+					action_id: "banner_position",
+					label: "Banner position",
+					options: [{
+						value: "bottom",
+						label: "Bottom of the viewport"
+					}, {
+						value: "top",
+						label: "Top of the viewport"
+					}],
+					initial_value: cfg.bannerPosition
+				},
 				{
 					type: "radio",
 					action_id: "analytics_platform",
@@ -1926,6 +2314,14 @@ async function buildSettingsPage(ctx) {
 							value: "gtm",
 							label: "Google Tag Manager (requires Marketing consent)"
 						},
+						{
+							value: "clarity",
+							label: "Microsoft Clarity (requires Analytics consent)"
+						},
+						{
+							value: "uet",
+							label: "Microsoft UET (requires Marketing consent)"
+						},
 						{
 							value: "none",
 							label: "None"
@@ -1951,8 +2347,8 @@ async function buildSettingsPage(ctx) {
 				{
 					type: "text_input",
 					action_id: "analytics_id",
-					label: "Analytics ID (domain, site ID, G-…, or GTM-…)",
-					placeholder: "example.com / G-XXXX / GTM-XXXX",
+					label: "Analytics ID (domain, site ID, G-…, GTM-…, Clarity project ID, or UET tag ID)",
+					placeholder: "example.com / G-XXXX / GTM-XXXX / Clarity ID / UET digits",
 					initial_value: cfg.analyticsId
 				},
 				{
@@ -2026,32 +2422,80 @@ async function buildSettingsPage(ctx) {
 					}],
 					initial_value: cfg.embedCategory
 				},
+				{
+					type: "radio",
+					action_id: "theme_profile",
+					label: "Banner theme",
+					options: [
+						{
+							value: "slate",
+							label: "Slate"
+						},
+						{
+							value: "paper",
+							label: "Paper"
+						},
+						{
+							value: "ink",
+							label: "Ink"
+						},
+						{
+							value: "indigo",
+							label: "Indigo"
+						},
+						{
+							value: "primer",
+							label: "Primer"
+						},
+						{
+							value: "custom",
+							label: "Custom colors"
+						}
+					],
+					initial_value: cfg.themeProfile
+				},
 				{
 					type: "text_input",
 					action_id: "theme_bg",
 					label: "Banner background (hex)",
-					placeholder: "#111111",
-					initial_value: cfg.theme.bg
+					placeholder: "#0f172a",
+					initial_value: cfg.theme.bg,
+					condition: {
+						field: "theme_profile",
+						eq: "custom"
+					}
 				},
 				{
 					type: "text_input",
 					action_id: "theme_text",
 					label: "Banner text (hex)",
-					placeholder: "#eeeeee",
-					initial_value: cfg.theme.text
+					placeholder: "#f8fafc",
+					initial_value: cfg.theme.text,
+					condition: {
+						field: "theme_profile",
+						eq: "custom"
+					}
 				},
 				{
 					type: "text_input",
 					action_id: "theme_accent",
 					label: "Banner accent (hex)",
 					placeholder: "#3b82f6",
-					initial_value: cfg.theme.accent
+					initial_value: cfg.theme.accent,
+					condition: {
+						field: "theme_profile",
+						eq: "custom"
+					}
 				},
 				{
 					type: "text_input",
 					action_id: "theme_radius",
 					label: "Banner corner radius (0–24 px)",
-					placeholder: "6",
+					condition: {
+						field: "theme_profile",
+						eq: "custom"
+					},
+					placeholder: "8",
 					initial_value: String(cfg.theme.radiusPx)
 				},
 				{
@@ -2079,16 +2523,20 @@ async function buildSettingsPage(ctx) {
 			type: "fields",
 			fields: vendorFields
 		},
-		...cfg.logConsentToServer && consentFields.length > 0 ? [
+		...cfg.logConsentToServer ? [
 			{ type: "divider" },
 			{
 				type: "header",
 				text: "Recent consent records"
 			},
 			{
+				type: "context",
+				text: `Download the log (up to ${RECORD_LOG_CAP} rows, no IP): ${EXPORT_PATH}. Signed-in admins only. Cells that start with = + - or @ are prefixed so a spreadsheet does not treat them as formulas.`
+			},
+			...consentFields.length > 0 ? [{
 				type: "fields",
 				fields: consentFields
-			}
+			}] : []
 		] : []
 	] };
 }