@emplugins/emprivacy 3.0.0 → 3.2.0

package/dist/index.mjs

@@ -20,7 +20,8 @@ const CHROME = {
 		embedBlocked: "This embed is blocked until you allow the matching cookie category.",
 		embedNeedConsent: "To load this embed, allow the matching category in cookie settings.",
 		vendorsHeading: "What this site uses",
-		whatWeUse: "What we use"
+		whatWeUse: "What we use",
+		gpcNote: "Your browser sent Global Privacy Control, so marketing stays off."
 	},
 	de: {
 		acceptAll: "Alle akzeptieren",
@@ -40,7 +41,8 @@ const CHROME = {
 		embedBlocked: "Diese Einbettung ist gesperrt, bis Sie die passende Kategorie erlauben.",
 		embedNeedConsent: "Um diese Einbettung zu laden, erlauben Sie die passende Kategorie in den Cookie-Einstellungen.",
 		vendorsHeading: "Was diese Website verwendet",
-		whatWeUse: "Was wir verwenden"
+		whatWeUse: "Was wir verwenden",
+		gpcNote: "Ihr Browser sendet Global Privacy Control, daher bleibt Marketing deaktiviert."
 	},
 	fr: {
 		acceptAll: "Tout accepter",
@@ -60,7 +62,8 @@ const CHROME = {
 		embedBlocked: "Ce contenu est bloqué tant que vous n’avez pas autorisé la catégorie correspondante.",
 		embedNeedConsent: "Pour charger ce contenu, autorisez la catégorie correspondante dans les paramètres des cookies.",
 		vendorsHeading: "Ce que ce site utilise",
-		whatWeUse: "Ce que nous utilisons"
+		whatWeUse: "Ce que nous utilisons",
+		gpcNote: "Votre navigateur envoie Global Privacy Control, donc le marketing reste désactivé."
 	},
 	es: {
 		acceptAll: "Aceptar todo",
@@ -80,7 +83,8 @@ const CHROME = {
 		embedBlocked: "Este contenido está bloqueado hasta que permita la categoría correspondiente.",
 		embedNeedConsent: "Para cargar este contenido, permita la categoría correspondiente en los ajustes de cookies.",
 		vendorsHeading: "Qué usa este sitio",
-		whatWeUse: "Qué usamos"
+		whatWeUse: "Qué usamos",
+		gpcNote: "Su navegador envía Global Privacy Control, así que el marketing permanece desactivado."
 	},
 	it: {
 		acceptAll: "Accetta tutto",
@@ -100,7 +104,8 @@ const CHROME = {
 		embedBlocked: "Questo contenuto è bloccato finché non consenti la categoria corrispondente.",
 		embedNeedConsent: "Per caricare questo contenuto, consenti la categoria corrispondente nelle impostazioni cookie.",
 		vendorsHeading: "Cosa usa questo sito",
-		whatWeUse: "Cosa usiamo"
+		whatWeUse: "Cosa usiamo",
+		gpcNote: "Il browser invia Global Privacy Control, quindi il marketing resta disattivato."
 	},
 	nl: {
 		acceptAll: "Alles accepteren",
@@ -120,7 +125,8 @@ const CHROME = {
 		embedBlocked: "Deze embed is geblokkeerd tot u de bijbehorende categorie toestaat.",
 		embedNeedConsent: "Om deze embed te laden, sta de bijbehorende categorie toe in de cookie-instellingen.",
 		vendorsHeading: "Wat deze site gebruikt",
-		whatWeUse: "Wat wij gebruiken"
+		whatWeUse: "Wat wij gebruiken",
+		gpcNote: "Uw browser stuurt Global Privacy Control, dus marketing blijft uit."
 	},
 	pt: {
 		acceptAll: "Aceitar tudo",
@@ -140,7 +146,8 @@ const CHROME = {
 		embedBlocked: "Este conteúdo está bloqueado até autorizar a categoria correspondente.",
 		embedNeedConsent: "Para carregar este conteúdo, autorize a categoria correspondente nas definições de cookies.",
 		vendorsHeading: "O que este site usa",
-		whatWeUse: "O que usamos"
+		whatWeUse: "O que usamos",
+		gpcNote: "O seu navegador enviou Global Privacy Control, por isso o marketing permanece desligado."
 	},
 	pl: {
 		acceptAll: "Zaakceptuj wszystkie",
@@ -160,7 +167,8 @@ const CHROME = {
 		embedBlocked: "Ta treść jest zablokowana, dopóki nie zezwolisz na odpowiednią kategorię.",
 		embedNeedConsent: "Aby wczytać tę treść, zezwól na odpowiednią kategorię w ustawieniach plików cookie.",
 		vendorsHeading: "Czego używa ta witryna",
-		whatWeUse: "Czego używamy"
+		whatWeUse: "Czego używamy",
+		gpcNote: "Przeglądarka wysłała Global Privacy Control, więc marketing pozostaje wyłączony."
 	}
 };
 function isLocaleKey(s) {
@@ -235,6 +243,8 @@ const FATHOM_ID = /^[A-Za-z0-9]{4,32}$/;
 const UMAMI_ID = /^[A-Za-z0-9-]{8,64}$/;
 const GA4_ID = /^G-[A-Z0-9]{4,14}$/;
 const GTM_ID = /^GTM-[A-Z0-9]{4,12}$/;
+const CLARITY_ID = /^[a-z0-9]{7,20}$/i;
+const UET_ID = /^[0-9]{6,12}$/;
 function isHostname$1(s) {
 	const t = s.trim().toLowerCase();
 	if (!t || t.length > 253) return false;
@@ -253,8 +263,23 @@ function isFathomId(s) {
 function isUmamiId(s) {
 	return UMAMI_ID.test(s.trim());
 }
+function isClarityId(s) {
+	return CLARITY_ID.test(s.trim());
+}
+function isUetId(s) {
+	return UET_ID.test(s.trim());
+}
 //#endregion
 //#region src/security.ts
+/**
+* Shared URL / request guards used by admin validation and (via mirrored
+* logic) the public bootstrap. Keep client checks in sync with these helpers.
+*/
+const YT_IFRAME = /^https:\/\/(?:www\.)?youtube-nocookie\.com\/embed\/[A-Za-z0-9_-]{11}\/?$/;
+const VIMEO_IFRAME = /^https:\/\/player\.vimeo\.com\/video\/\d{6,12}\/?$/;
+/** Sandbox and feature policy for YouTube/Vimeo iframes. Kept beside the src regexes. */
+const EMBED_IFRAME_SANDBOX = "allow-scripts allow-same-origin allow-presentation";
+const EMBED_IFRAME_ALLOW = "accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture; web-share";
 /** Hosts EmPrivacy may load as <script src> for built-in presets. */
 const PRESET_SCRIPT_HOSTS = /* @__PURE__ */ new Set([
 	"static.cloudflareinsights.com",
@@ -262,7 +287,10 @@ const PRESET_SCRIPT_HOSTS = /* @__PURE__ */ new Set([
 	"cdn.usefathom.com",
 	"scripts.simpleanalyticscdn.com",
 	"www.googletagmanager.com",
-	"googletagmanager.com"
+	"googletagmanager.com",
+	"www.clarity.ms",
+	"clarity.ms",
+	"bat.bing.com"
 ]);
 const HOSTNAME = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i;
 function normalizeCookieMaxAgeDays(n, fallback = 180) {
@@ -283,6 +311,85 @@ function cookieMaxAgeSeconds(days) {
 function hasUnsafeUrlChars$1(s) {
 	return /[\u0000-\u001F\u007F\s]/.test(s);
 }
+/**
+* Browser copy of the non-public host check. `parseStrictHttpsUrl` calls the
+* same source so the inline bootstrap cannot drift from the server.
+* Hostnames are whatever `new URL` already normalized (decimal, hex, and
+* short IPv4 forms become dotted quads; IPv6 keeps brackets).
+*/
+function hostnameBlockScript() {
+	return `function hostBlocked(raw){
+var host=String(raw||"").trim().toLowerCase().replace(/^\\[|\\]$/g,"");
+if(!host)return true;
+if(host==="localhost"||endsWith(host,".localhost")||endsWith(host,".local")||endsWith(host,".internal")||endsWith(host,".arpa"))return true;
+if(host.indexOf(":")>=0)return ipv6Blocked(host);
+if(/^[0-9.]+$/.test(host)){
+var v4=parseV4(host);
+if(v4===null)return true;
+return v4Blocked(v4);
+}
+return false;
+}
+function endsWith(h,s){return h.length>=s.length&&h.slice(h.length-s.length)===s;}
+function parseV4(host){
+var p=host.split(".");
+if(p.length!==4)return null;
+var n=0;
+for(var i=0;i<p.length;i++){
+var part=p[i];
+if(!/^\\d{1,3}$/.test(part))return null;
+if(part.length>1&&part.charAt(0)==="0")return null;
+var v=+part;
+if(v>255)return null;
+n=n*256+v;
+}
+return n>>>0;
+}
+function v4Blocked(n){
+var a=n>>>24;
+var b=(n>>>16)&255;
+if(a===0||a===10||a===127)return true;
+if(a===100&&b>=64&&b<=127)return true;
+if(a===169&&b===254)return true;
+if(a===172&&b>=16&&b<=31)return true;
+if(a===192&&b===168)return true;
+if(a>=224)return true;
+return false;
+}
+function ipv6Blocked(host){
+if(host==="::"||host==="::1")return true;
+var dotted=/^::ffff:(\\d{1,3}(?:\\.\\d{1,3}){3})$/.exec(host);
+if(dotted){
+var d4=parseV4(dotted[1]);
+return d4===null||v4Blocked(d4);
+}
+var mapped=/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(host);
+if(mapped){
+var hi=parseInt(mapped[1],16);
+var lo=parseInt(mapped[2],16);
+if(hi>65535||lo>65535)return true;
+return v4Blocked(((hi<<16)|lo)>>>0);
+}
+if(/\\d{1,3}(?:\\.\\d{1,3}){3}$/.test(host))return true;
+var first;
+if(host.slice(0,2)==="::")first=0;
+else{
+var head=host.split(":")[0];
+if(!/^[0-9a-f]{1,4}$/.test(head))return true;
+first=parseInt(head,16);
+}
+if((first&0xfe00)===0xfc00)return true;
+if((first&0xffc0)===0xfe80)return true;
+if((first&0xffc0)===0xfec0)return true;
+if((first&0xff00)===0xff00)return true;
+return false;
+}`;
+}
+const hostBlockedImpl = new Function(`${hostnameBlockScript()}\nreturn hostBlocked;`)();
+/** True for loopback, private, link-local, shared (CGNAT), and non-global addresses. */
+function isBlockedHostname(hostname) {
+	return hostBlockedImpl(hostname);
+}
 function parseStrictHttpsUrl(raw) {
 	const t = raw.trim();
 	if (!t || t.length > 2048 || hasUnsafeUrlChars$1(t)) return null;
@@ -291,9 +398,7 @@ function parseStrictHttpsUrl(raw) {
 		const u = new URL(t);
 		if (u.protocol !== "https:") return null;
 		if (u.username || u.password) return null;
-		const host = u.hostname.toLowerCase();
-		if (host === "localhost" || host.endsWith(".localhost")) return null;
-		if (host === "127.0.0.1" || host === "::1" || host.endsWith(".local")) return null;
+		if (isBlockedHostname(u.hostname)) return null;
 		return u;
 	} catch {
 		return null;
@@ -326,9 +431,18 @@ function isScriptHostAllowed(raw, opts) {
 	if (!u) return false;
 	const host = u.hostname.toLowerCase();
 	if (opts.allowPresets && PRESET_SCRIPT_HOSTS.has(host)) return true;
-	if (opts.allowlist.length === 0) return true;
 	return opts.allowlist.includes(host);
 }
+/** SRI required before a custom or marketing script may load. Empty is not valid. */
+function hasSri(s) {
+	return typeof s === "string" && /^sha(?:256|384|512)-[A-Za-z0-9+/=]+$/.test(s);
+}
+function isPublishableCustomScript(src, integrity, allowlist) {
+	return hasSri(integrity) && isScriptHostAllowed(src, {
+		allowlist: [...allowlist],
+		allowPresets: false
+	});
+}
 /** Optional SRI: `https://cdn.example/a.js sha384-...` or `... integrity=sha384-...`. */
 function parseScriptUrlWithIntegrity(line) {
 	const t = line.trim();
@@ -368,6 +482,29 @@ function assertSameOriginMutation(request, expectedOrigin) {
 	if ((request.headers.get("sec-fetch-site") ?? "").toLowerCase() === "same-origin") return null;
 	return new Response("forbidden", { status: 403 });
 }
+/**
+* Compare-and-set increment. Returns false when the bucket is full, the store
+* errors, or eight conflicts in a row fail to land a write.
+*/
+async function tryConsumeRateSlot(kv, key, limit) {
+	for (let attempt = 0; attempt < 8; attempt++) {
+		let current;
+		try {
+			current = await kv.getVersioned(key);
+		} catch {
+			return false;
+		}
+		const raw = current?.value;
+		const n = typeof raw === "string" && /^\d{1,6}$/.test(raw) ? Number(raw) : 0;
+		if (n >= limit) return false;
+		try {
+			if ((await kv.compareAndSet(key, current ? current.revision : null, String(n + 1))).applied) return true;
+		} catch {
+			return false;
+		}
+	}
+	return false;
+}
 /** Coarse hour bucket for rate limiting (UTC). */
 function rateHourKey(now = /* @__PURE__ */ new Date()) {
 	return `${now.getUTCFullYear()}${String(now.getUTCMonth() + 1).padStart(2, "0")}${String(now.getUTCDate()).padStart(2, "0")}${String(now.getUTCHours()).padStart(2, "0")}`;
@@ -376,12 +513,81 @@ function rateHourKey(now = /* @__PURE__ */ new Date()) {
 //#region src/theme.ts
 /** Hex colors only — rejects CSS injection via theme fields. */
 const HEX = /^#(?:[0-9A-Fa-f]{3}|[0-9A-Fa-f]{6}|[0-9A-Fa-f]{8})$/;
+/** Fixed banner palettes. Colors are constants, never taken from the admin form. */
+const THEME_PROFILES = {
+	slate: {
+		bg: "#0f172a",
+		text: "#f8fafc",
+		accent: "#3b82f6",
+		radiusPx: 8
+	},
+	paper: {
+		bg: "#f7f6f3",
+		text: "#37352f",
+		accent: "#1d4ed8",
+		radiusPx: 6
+	},
+	ink: {
+		bg: "#000000",
+		text: "#ededed",
+		accent: "#0070f3",
+		radiusPx: 8
+	},
+	indigo: {
+		bg: "#ffffff",
+		text: "#0f172a",
+		accent: "#4f46e5",
+		radiusPx: 12
+	},
+	primer: {
+		bg: "#f6f8fa",
+		text: "#1f2328",
+		accent: "#0969da",
+		radiusPx: 6
+	}
+};
+const THEME_PROFILE_IDS = [
+	"slate",
+	"paper",
+	"ink",
+	"indigo",
+	"primer"
+];
+/** First profile. New installs and configs with no theme choice use this. */
+const DEFAULT_THEME_PROFILE = THEME_PROFILE_IDS[0];
 const DEFAULT_THEME = {
-	bg: "#111111",
-	text: "#eeeeee",
-	accent: "#3b82f6",
-	radiusPx: 6
+	bg: THEME_PROFILES[DEFAULT_THEME_PROFILE].bg,
+	text: THEME_PROFILES[DEFAULT_THEME_PROFILE].text,
+	accent: THEME_PROFILES[DEFAULT_THEME_PROFILE].accent,
+	radiusPx: THEME_PROFILES[DEFAULT_THEME_PROFILE].radiusPx
 };
+function isThemeProfileId(value) {
+	return THEME_PROFILE_IDS.includes(value);
+}
+/** Stored JSON: a missing or unknown choice uses the first profile. Explicit `custom` is kept. */
+function normalizeThemeChoice(value) {
+	if (value === "custom") return "custom";
+	if (typeof value === "string" && isThemeProfileId(value)) return value;
+	return DEFAULT_THEME_PROFILE;
+}
+/** Admin save: blank uses the first profile. `custom` is the manual option. */
+function parseThemeChoice(value) {
+	const t = value.trim().toLowerCase();
+	if (!t) return DEFAULT_THEME_PROFILE;
+	if (t === "custom") return "custom";
+	if (isThemeProfileId(t)) return t;
+	throw new Error("Banner theme must be Custom, Slate, Paper, Ink, Indigo, or Primer.");
+}
+function themeForChoice(choice, custom) {
+	if (choice === "custom") return custom;
+	const profile = THEME_PROFILES[choice];
+	return {
+		bg: profile.bg,
+		text: profile.text,
+		accent: profile.accent,
+		radiusPx: profile.radiusPx
+	};
+}
 function isSafeHexColor(s) {
 	return HEX.test(s.trim());
 }
@@ -424,14 +630,17 @@ const DEFAULT_CONFIG = {
 	marketingScriptUrls: [],
 	scriptIntegrity: {},
 	scriptHostAllowlist: [],
+	embedHostAllowlist: [],
 	cookieMaxAgeDays: 180,
 	googleConsentMode: false,
 	logConsentToServer: false,
 	embedCategory: "marketing",
 	gateEmbeds: true,
 	hideBannerOnPolicyPages: true,
+	bannerPosition: "bottom",
 	defaultLocale: "en",
 	localeOverrides: {},
+	themeProfile: "slate",
 	theme: { ...DEFAULT_THEME }
 };
 const ANALYTICS_PROVIDERS = [
@@ -443,8 +652,13 @@ const ANALYTICS_PROVIDERS = [
 	"umami",
 	"simpleanalytics",
 	"ga4",
-	"gtm"
+	"gtm",
+	"clarity",
+	"uet"
 ];
+function normalizeBannerPosition(value) {
+	return value === "top" ? "top" : "bottom";
+}
 function hasUnsafeUrlChars(s) {
 	return /[\u0000-\u001F\u007F\s]/.test(s);
 }
@@ -561,6 +775,7 @@ function normalizeConfig(raw) {
 		if (Object.keys(scriptIntegrity).length >= 100) break;
 	}
 	const scriptHostAllowlist = (Array.isArray(o.scriptHostAllowlist) ? o.scriptHostAllowlist.filter((x) => typeof x === "string") : []).map((h) => h.trim().toLowerCase()).filter((h) => isHostname$1(h)).slice(0, 50);
+	const embedHostAllowlist = (Array.isArray(o.embedHostAllowlist) ? o.embedHostAllowlist.filter((x) => typeof x === "string") : []).map((h) => h.trim().toLowerCase()).filter((h) => isHostname$1(h)).slice(0, 50);
 	return {
 		bannerTitle: typeof o.bannerTitle === "string" ? o.bannerTitle : DEFAULT_CONFIG.bannerTitle,
 		bannerMessage: typeof o.bannerMessage === "string" ? o.bannerMessage : DEFAULT_CONFIG.bannerMessage,
@@ -576,20 +791,23 @@ function normalizeConfig(raw) {
 		marketingScriptUrls: marketing,
 		scriptIntegrity,
 		scriptHostAllowlist,
+		embedHostAllowlist,
 		cookieMaxAgeDays: normalizeCookieMaxAgeDays(o.cookieMaxAgeDays, DEFAULT_CONFIG.cookieMaxAgeDays),
 		googleConsentMode: typeof o.googleConsentMode === "boolean" ? o.googleConsentMode : DEFAULT_CONFIG.googleConsentMode,
 		logConsentToServer: typeof o.logConsentToServer === "boolean" ? o.logConsentToServer : DEFAULT_CONFIG.logConsentToServer,
 		embedCategory: isEmbedCategory(embedRaw) ? embedRaw : DEFAULT_CONFIG.embedCategory,
 		gateEmbeds: typeof o.gateEmbeds === "boolean" ? o.gateEmbeds : DEFAULT_CONFIG.gateEmbeds,
 		hideBannerOnPolicyPages: typeof o.hideBannerOnPolicyPages === "boolean" ? o.hideBannerOnPolicyPages : DEFAULT_CONFIG.hideBannerOnPolicyPages,
+		bannerPosition: normalizeBannerPosition(o.bannerPosition),
 		defaultLocale: typeof o.defaultLocale === "string" && o.defaultLocale ? o.defaultLocale : DEFAULT_CONFIG.defaultLocale,
 		localeOverrides: parseLocaleOverrides(o.localeOverrides),
-		theme: {
+		themeProfile: normalizeThemeChoice(o.themeProfile),
+		theme: themeForChoice(normalizeThemeChoice(o.themeProfile), {
 			bg: normalizeHexColor(typeof themeRaw.bg === "string" ? themeRaw.bg : "", DEFAULT_THEME.bg),
 			text: normalizeHexColor(typeof themeRaw.text === "string" ? themeRaw.text : "", DEFAULT_THEME.text),
 			accent: normalizeHexColor(typeof themeRaw.accent === "string" ? themeRaw.accent : "", DEFAULT_THEME.accent),
 			radiusPx: normalizeRadiusPx(themeRaw.radiusPx, DEFAULT_THEME.radiusPx)
-		}
+		})
 	};
 }
 function assertAnalyticsId(provider, id, umamiScriptUrl) {
@@ -604,7 +822,7 @@ function assertAnalyticsId(provider, id, umamiScriptUrl) {
 	}
 	if (provider === "umami") {
 		if (!isUmamiId(t)) throw new Error("Umami website ID looks invalid.");
-		if (!isHttpsUrl(umamiScriptUrl)) throw new Error("Umami requires the https script URL (Cloud or your self-hosted tracker).");
+		if (!isSafeHttpsScriptUrl(umamiScriptUrl)) throw new Error("Umami requires an https script URL on a public host (Cloud or your self-hosted tracker).");
 		return;
 	}
 	if (provider === "ga4") {
@@ -615,6 +833,14 @@ function assertAnalyticsId(provider, id, umamiScriptUrl) {
 		if (!isGtmId(t)) throw new Error("Google Tag Manager ID must look like GTM-XXXX.");
 		return;
 	}
+	if (provider === "clarity") {
+		if (!isClarityId(t)) throw new Error("Clarity project ID must be 7–20 letters or digits.");
+		return;
+	}
+	if (provider === "uet") {
+		if (!isUetId(t)) throw new Error("UET tag ID must be 6–12 digits.");
+		return;
+	}
 	if (provider === "simpleanalytics" && t && !isHostname$1(t)) throw new Error("Simple Analytics hostname must be a domain like example.com, or empty.");
 }
 /** Validate admin-submitted fields; throws an Error with a short message on failure */
@@ -634,22 +860,23 @@ function assertValidSavedConfig(input) {
 	const tokenTrim = input.cloudflareToken.trim();
 	if (ap === "cloudflare") assertValidCloudflareToken(tokenTrim);
 	const umamiScriptUrl = input.umamiScriptUrl.trim();
-	if (ap === "umami" && umamiScriptUrl && !isHttpsUrl(umamiScriptUrl)) throw new Error(invalidScriptUrlError("umami", umamiScriptUrl));
+	if (ap === "umami" && umamiScriptUrl && !isSafeHttpsScriptUrl(umamiScriptUrl)) throw new Error(invalidScriptUrlError("umami", umamiScriptUrl));
 	if (ap !== "none" && ap !== "custom" && ap !== "cloudflare" && ap !== "simpleanalytics" && ap !== "gtm") assertAnalyticsId(ap, input.analyticsId, umamiScriptUrl);
 	else if (ap === "simpleanalytics" && input.analyticsId.trim()) assertAnalyticsId(ap, input.analyticsId, umamiScriptUrl);
 	else if (ap === "gtm") assertAnalyticsId(ap, input.analyticsId, umamiScriptUrl);
 	const scriptHostAllowlist = parseHostnameAllowlist(input.scriptHostAllowlistText);
+	const embedHostAllowlist = parseHostnameAllowlist(input.embedHostAllowlistText);
 	const cookieMaxAgeDays = parseCookieMaxAgeDays(input.cookieMaxAgeDays, 180);
 	const scriptIntegrity = {};
 	const assertScriptLine = (kind, line) => {
 		const { src, integrity } = parseScriptUrlWithIntegrity(line);
 		if (!src || src.length > 2048) throw new Error(invalidScriptUrlError(kind, line));
 		if (!isSafeHttpsScriptUrl(src)) throw new Error(invalidScriptUrlError(kind, src));
-		if (integrity && !isValidIntegrity(integrity)) throw new Error(`Invalid SRI for ${kind} script (expected sha256-|sha384-|sha512-…).`);
+		if (!hasSri(integrity)) throw new Error(`${kind} scripts require Subresource Integrity (sha256-, sha384-, or sha512-) after the URL.`);
 		if (!isScriptHostAllowed(src, {
 			allowlist: scriptHostAllowlist,
 			allowPresets: false
-		})) throw new Error(`${kind} script host is not on the allowlist. Add the hostname or clear the allowlist.`);
+		})) throw new Error(`${kind} script host is not on the allowlist. Add the hostname under Script host allowlist.`);
 		if (integrity) scriptIntegrity[src] = integrity;
 		return src;
 	};
@@ -657,7 +884,7 @@ function assertValidSavedConfig(input) {
 		if (!isScriptHostAllowed(umamiScriptUrl, {
 			allowlist: scriptHostAllowlist,
 			allowPresets: false
-		})) throw new Error("Umami script host is not on the allowlist. Add the hostname or clear the allowlist.");
+		})) throw new Error("Umami script host is not on the allowlist. Add the hostname under Script host allowlist.");
 	}
 	const analyticsScriptUrls = [];
 	if (ap === "custom") {
@@ -673,17 +900,22 @@ function assertValidSavedConfig(input) {
 	if (!isEmbedCategory(embedCategory)) throw new Error("Embeds must require Functional or Marketing consent.");
 	const defaultLocale = input.defaultLocale.trim().toLowerCase() || "en";
 	if (!/^[a-z]{2,3}(?:-[a-z]{2})?$/.test(defaultLocale)) throw new Error("Default locale must look like en or pt-BR.");
+	const bannerPosition = input.bannerPosition.trim().toLowerCase();
+	if (bannerPosition !== "top" && bannerPosition !== "bottom") throw new Error("Banner position must be top or bottom.");
 	const localeOverrides = parseLocaleOverridesText(input.localeOverridesText);
 	for (const pack of Object.values(localeOverrides)) {
 		if (pack.bannerTitle !== void 0) assertOptionalLength("Translated banner title", pack.bannerTitle, 120);
 		if (pack.bannerMessage !== void 0) assertOptionalLength("Translated short notice", pack.bannerMessage, 600);
 	}
+	const themeProfile = parseThemeChoice(input.themeProfile);
 	const themeBg = input.themeBg.trim() || DEFAULT_THEME.bg;
 	const themeText = input.themeText.trim() || DEFAULT_THEME.text;
 	const themeAccent = input.themeAccent.trim() || DEFAULT_THEME.accent;
-	if (input.themeBg.trim() && !/^#(?:[0-9A-Fa-f]{3}|[0-9A-Fa-f]{6}|[0-9A-Fa-f]{8})$/.test(themeBg)) throw new Error("Banner background must be a hex color like #111111.");
-	if (input.themeText.trim() && !/^#(?:[0-9A-Fa-f]{3}|[0-9A-Fa-f]{6}|[0-9A-Fa-f]{8})$/.test(themeText)) throw new Error("Banner text color must be a hex color like #eeeeee.");
-	if (input.themeAccent.trim() && !/^#(?:[0-9A-Fa-f]{3}|[0-9A-Fa-f]{6}|[0-9A-Fa-f]{8})$/.test(themeAccent)) throw new Error("Banner accent color must be a hex color like #3b82f6.");
+	if (themeProfile === "custom") {
+		if (input.themeBg.trim() && !/^#(?:[0-9A-Fa-f]{3}|[0-9A-Fa-f]{6}|[0-9A-Fa-f]{8})$/.test(themeBg)) throw new Error("Banner background must be a hex color like #111111.");
+		if (input.themeText.trim() && !/^#(?:[0-9A-Fa-f]{3}|[0-9A-Fa-f]{6}|[0-9A-Fa-f]{8})$/.test(themeText)) throw new Error("Banner text color must be a hex color like #eeeeee.");
+		if (input.themeAccent.trim() && !/^#(?:[0-9A-Fa-f]{3}|[0-9A-Fa-f]{6}|[0-9A-Fa-f]{8})$/.test(themeAccent)) throw new Error("Banner accent color must be a hex color like #3b82f6.");
+	}
 	return normalizeConfig({
 		bannerTitle: input.bannerTitle.trim() || DEFAULT_CONFIG.bannerTitle,
 		bannerMessage: input.bannerMessage.trim() || DEFAULT_CONFIG.bannerMessage,
@@ -699,20 +931,23 @@ function assertValidSavedConfig(input) {
 		marketingScriptUrls,
 		scriptIntegrity,
 		scriptHostAllowlist,
+		embedHostAllowlist,
 		cookieMaxAgeDays,
 		googleConsentMode: input.googleConsentMode,
 		logConsentToServer: input.logConsentToServer,
 		embedCategory,
 		gateEmbeds: input.gateEmbeds,
 		hideBannerOnPolicyPages: input.hideBannerOnPolicyPages,
+		bannerPosition,
 		defaultLocale,
 		localeOverrides,
-		theme: {
+		themeProfile,
+		theme: themeForChoice(themeProfile, themeProfile === "custom" ? {
 			bg: themeBg,
 			text: themeText,
 			accent: themeAccent,
 			radiusPx: parseRadiusInput(input.themeRadius, DEFAULT_THEME.radiusPx)
-		}
+		} : { ...DEFAULT_THEME })
 	});
 }
 /** Safe to embed in `<script type="application/json">` (breakout-safe) */
@@ -830,19 +1065,83 @@ async function fetchLatestPublishedVersion(options) {
 	}
 }
 //#endregion
+//#region src/consent-csv.ts
+const FORMULA_PREFIX = /^[\t\r ]*[=+\-@]/;
+/** Quote a cell and neutralize spreadsheet formula injection. */
+function csvCell(value) {
+	let s = value.replace(/\r\n|\n|\r/g, " ");
+	if (FORMULA_PREFIX.test(s)) s = `'${s}`;
+	return `"${s.replace(/"/g, "\"\"")}"`;
+}
+function boolCell(value) {
+	return value === true ? "true" : value === false ? "false" : "";
+}
+function buildConsentCsv(rows) {
+	const lines = [[
+		"createdAt",
+		"policyVersion",
+		"functional",
+		"analytics",
+		"marketing",
+		"gpc"
+	].map(csvCell).join(",")];
+	for (const row of rows) lines.push([
+		csvCell(typeof row.createdAt === "string" ? row.createdAt : ""),
+		csvCell(typeof row.policyVersion === "string" ? row.policyVersion : ""),
+		csvCell(boolCell(row.functional)),
+		csvCell(boolCell(row.analytics)),
+		csvCell(boolCell(row.marketing)),
+		csvCell(row.gpc === true ? "true" : "")
+	].join(","));
+	return `\uFEFF${lines.join("\r\n")}\r\n`;
+}
+//#endregion
+//#region src/cookie-purge.ts
+const ANALYTICS_COOKIE_EXACT = [
+	"_ga",
+	"_gid",
+	"_gat"
+];
+const ANALYTICS_COOKIE_PREFIX = ["_ga_", "_gat_"];
+const MARKETING_COOKIE_EXACT = [
+	"_gcl_au",
+	"_gcl_aw",
+	"_gcl_dc",
+	"_clck",
+	"_clsk",
+	"CLID",
+	"_uetsid",
+	"_uetvid"
+];
+const MARKETING_COOKIE_PREFIX = ["_gcl_"];
+const PURGE_RULES = {
+	analytics: {
+		exact: [...ANALYTICS_COOKIE_EXACT],
+		prefix: [...ANALYTICS_COOKIE_PREFIX]
+	},
+	marketing: {
+		exact: [...MARKETING_COOKIE_EXACT],
+		prefix: [...MARKETING_COOKIE_PREFIX]
+	}
+};
+//#endregion
 //#region src/public-bootstrap.ts
 /**
 * Public-site bootstrap. Banner copy is applied with textContent / createTextNode only.
 * Embed/script URLs are re-validated in the browser (never trust DOM data-src alone).
 */
 function buildBodyBootstrap(pr) {
+	const jsonLiteral = jsonForHtmlScript(pr);
+	const purgeLiteral = jsonForHtmlScript(PURGE_RULES);
 	return `(function(){
-var C=${jsonForHtmlScript(pr)};
+var C=${jsonLiteral};
 var CN="${COOKIE_NAME}";
+var PURGE=${purgeLiteral};
 var listeners=[];
-var PRESET_HOSTS={"static.cloudflareinsights.com":1,"plausible.io":1,"cdn.usefathom.com":1,"scripts.simpleanalyticscdn.com":1,"www.googletagmanager.com":1,"googletagmanager.com":1};
-var YT_IFRAME=/^https:\\/\\/(?:www\\.)?youtube-nocookie\\.com\\/embed\\/[A-Za-z0-9_-]{11}\\/?$/;
-var VIMEO_IFRAME=/^https:\\/\\/player\\.vimeo\\.com\\/video\\/\\d{6,12}\\/?$/;
+var PRESET_HOSTS=${jsonForHtmlScript(Object.fromEntries([...PRESET_SCRIPT_HOSTS].map((host) => [host, 1])))};
+var YT_IFRAME=${YT_IFRAME.toString()};
+var VIMEO_IFRAME=${VIMEO_IFRAME.toString()};
+${hostnameBlockScript()}
 function readCookie(){
 try{
 var m=document.cookie.match(new RegExp("(?:^|;\\\\s*)"+CN+"=([^;]*)"));
@@ -867,7 +1166,64 @@ if(!flagOk(o.a)||!flagOk(o.m)||!flagOk(o.f))return null;
 return {v:o.v,essential:true,functional:!!o.f,analytics:!!o.a,marketing:!!o.m};
 }catch(e){return null;}
 }
-function currentState(){return parseState(readCookie());}
+function gpcOn(){
+try{return navigator.globalPrivacyControl===true;}catch(e){return false;}
+}
+function effective(st){
+if(!st)return null;
+var g=gpcOn();
+return {v:st.v,essential:true,functional:!!st.functional,analytics:!!st.analytics,marketing:g?false:!!st.marketing,gpc:g};
+}
+function currentState(){return effective(parseState(readCookie()));}
+function cookieNameOk(name){return /^[A-Za-z0-9_]{1,64}$/.test(name);}
+function expireCookie(name){
+if(!cookieNameOk(name)||name===CN)return;
+var secure=document.location.protocol==="https:"?"; Secure":"";
+var base=name+"=; Max-Age=0; Path=/; SameSite=Lax"+secure;
+document.cookie=base;
+var host=String(document.location.hostname||"");
+if(!/^[A-Za-z0-9.-]{1,253}$/.test(host)||host.indexOf("..")>=0)return;
+var hosts=[host];
+var labels=host.split(".");
+if(labels.length>=3)hosts.push(labels.slice(1).join("."));
+for(var i=0;i<hosts.length;i++){
+var h=hosts[i];
+if(!/^[A-Za-z0-9.-]{1,253}$/.test(h))continue;
+document.cookie=base+"; Domain="+h;
+document.cookie=base+"; Domain=."+h;
+}
+}
+function purgeSet(exact,prefixes){
+var raw="";
+try{raw=document.cookie;}catch(e){return;}
+if(!raw)return;
+if(raw.length>8192)raw=raw.slice(0,8192);
+raw.split(";").forEach(function(part){
+var name=(part.split("=")[0]||"").replace(/^\\s+/,"");
+if(!cookieNameOk(name)||name===CN)return;
+var hit=exact.indexOf(name)>=0;
+if(!hit){
+for(var i=0;i<prefixes.length;i++){
+if(prefixes[i]&&name.indexOf(prefixes[i])===0){hit=true;break;}
+}
+}
+if(hit)expireCookie(name);
+});
+}
+function purgeDenied(st){
+var rules=PURGE||{};
+if(!st.analytics){
+var a=rules.analytics||{};
+purgeSet(a.exact||[],a.prefix||[]);
+}
+if(!st.marketing){
+var m=rules.marketing||{};
+purgeSet(m.exact||[],m.prefix||[]);
+}
+}
+function deniedState(){
+return {v:"",essential:true,functional:false,analytics:false,marketing:false,gpc:gpcOn()};
+}
 function emit(st){
 listeners.slice().forEach(function(fn){try{fn(st);}catch(e){}});
 try{document.dispatchEvent(new CustomEvent("emprivacy:change",{detail:st}));}catch(e){}
@@ -884,8 +1240,7 @@ if(/%0d|%0a|%09|%0b|%0c|%20/i.test(raw))return null;
 var u=new URL(raw);
 if(u.protocol!=="https:")return null;
 if(u.username||u.password)return null;
-var h=u.hostname.toLowerCase();
-if(h==="localhost"||h.endsWith(".localhost")||h==="127.0.0.1"||h==="::1")return null;
+if(hostBlocked(u.hostname))return null;
 return u;
 }catch(e){return null;}
 }
@@ -893,7 +1248,6 @@ function hostAllowed(u,allowPresets){
 var h=u.hostname.toLowerCase();
 if(allowPresets&&PRESET_HOSTS[h])return true;
 var list=C.scriptHostAllowlist||[];
-if(!list.length)return true;
 return list.indexOf(h)>=0;
 }
 function safeScriptUrl(raw,allowPresets){
@@ -903,7 +1257,7 @@ if(!hostAllowed(u,!!allowPresets))return null;
 return u.href;
 }
 function allowedIframe(src){return YT_IFRAME.test(src)||VIMEO_IFRAME.test(src);}
-function allowedLink(src,kind){
+function allowedLink(src){
 var u=parseHttps(src);
 if(!u)return false;
 var h=u.hostname.toLowerCase();
@@ -916,20 +1270,22 @@ return /^\\/profile\\/[^/]+\\/post\\/[^/]+\\/?$/.test(u.pathname);
 if(h==="gist.github.com"){
 return /^\\/[A-Za-z0-9-]{1,39}\\/[a-f0-9]{8,64}\\/?$/i.test(u.pathname);
 }
-if(/^\\/@[^/]+\\/\\d+\\/?$/.test(u.pathname)||/^\\/users\\/[^/]+\\/statuses\\/\\d+\\/?$/.test(u.pathname))return true;
-return kind==="linkPreview";
+var list=C.embedHostAllowlist||[];
+return list.indexOf(h)>=0;
 }
 function alreadyScriptSrc(u){
 try{
 return Array.prototype.some.call(document.getElementsByTagName("script"),function(s){return s.src===u;});
 }catch(e){return false;}
 }
-function loadScript(src, attrs, integrity, allowPresets){
+function loadScript(src, attrs, integrity, allowPresets, requireIntegrity){
 var safe=safeScriptUrl(src,allowPresets);
 if(!safe||alreadyScriptSrc(safe))return;
+var sriOk=integrity&&/^sha(?:256|384|512)-[A-Za-z0-9+/=]+$/.test(integrity);
+if(requireIntegrity&&!sriOk)return;
 var e=document.createElement("script");
 e.src=safe;e.async=true;e.referrerPolicy="no-referrer-when-downgrade";
-if(integrity&&/^sha(?:256|384|512)-[A-Za-z0-9+/=]+$/.test(integrity)){
+if(sriOk){
 e.integrity=integrity;
 e.crossOrigin="anonymous";
 }
@@ -951,10 +1307,10 @@ e.setAttribute("data-cf-beacon",JSON.stringify({token:token}));
 e.referrerPolicy="no-referrer-when-downgrade";
 document.head.appendChild(e);
 }
-function applyAnalytics(){
+function applyAnalytics(st){
 var L=C.loader||{type:"none"};
 if(L.type==="cloudflare") loadCloudflareBeacon(L.token);
-else if(L.type==="custom") (L.scripts||[]).forEach(function(s){loadScript(s.src,null,s.integrity,false);});
+else if(L.type==="custom") (L.scripts||[]).forEach(function(s){loadScript(s.src,null,s.integrity,false,true);});
 else if(L.type==="plausible") loadScript(L.src,{"data-domain":L.domain},null,true);
 else if(L.type==="fathom") loadScript(L.src,{"data-site":L.siteId},null,true);
 else if(L.type==="umami") loadScript(L.src,{"data-website-id":L.websiteId},null,false);
@@ -966,20 +1322,48 @@ loadScript("https://www.googletagmanager.com/gtag/js?id="+encodeURIComponent(L.m
 window.gtag("js",new Date());
 window.gtag("config",L.measurementId);
 }
+else if(L.type==="clarity"){
+var id=String(L.projectId||"");
+if(!/^[a-z0-9]{7,20}$/i.test(id))return;
+window.clarity=window.clarity||function(){(window.clarity.q=window.clarity.q||[]).push(arguments);};
+window.clarity("consentv2",{ad_Storage:st.marketing?"granted":"denied",analytics_Storage:"granted"});
+loadScript("https://www.clarity.ms/tag/"+encodeURIComponent(id),null,null,true);
+}
 }
 function applyMarketing(){
 var urls=C.marketingScripts||[];
-urls.forEach(function(s){loadScript(s.src,null,s.integrity,false);});
+urls.forEach(function(s){loadScript(s.src,null,s.integrity,false,true);});
 var L=C.loader||{type:"none"};
 if(L.type==="gtm"){
 window.dataLayer=window.dataLayer||[];
 window.dataLayer.push({"gtm.start":Date.now(),event:"gtm.js"});
 loadScript("https://www.googletagmanager.com/gtm.js?id="+encodeURIComponent(L.containerId),null,null,true);
 }
+else if(L.type==="uet"){
+var id=String(L.tagId||"");
+if(!/^[0-9]{6,12}$/.test(id))return;
+window.uetq=window.uetq||[];
+window.uetq.push("consent","update",{"ad_storage":"granted"});
+var src="https://bat.bing.com/bat.js";
+if(alreadyScriptSrc(src))return;
+var n=document.createElement("script");
+n.src=src;
+n.async=true;
+n.onload=function(){
+try{
+var q=window.uetq;
+window.uetq=new window.UET({ti:id,enableAutoSpaTracking:false,q:q});
+window.uetq.push("pageLoad");
+}catch(e){}
+};
+document.head.appendChild(n);
+}
 }
 function applyScripts(st){
-if(st.analytics) applyAnalytics();
-if(st.marketing) applyMarketing();
+var eff=effective(st)||st;
+purgeDenied(eff);
+if(eff.analytics) applyAnalytics(eff);
+if(eff.marketing) applyMarketing();
 }
 function gtagUpdate(st){
 if(!C.googleConsentMode||!window.gtag)return;
@@ -999,7 +1383,7 @@ fetch(C.recordPath,{
 method:"POST",
 credentials:"same-origin",
 headers:{"Content-Type":"application/json"},
-body:JSON.stringify({policyVersion:C.policyVersion,functional:!!st.functional,analytics:!!st.analytics,marketing:!!st.marketing})
+body:JSON.stringify({policyVersion:C.policyVersion,functional:!!st.functional,analytics:!!st.analytics,marketing:!!st.marketing,gpc:!!st.gpc})
 }).catch(function(){});
 }
 function hide(el){if(el)el.setAttribute("hidden","");el&&(el.style.display="none");}
@@ -1014,17 +1398,17 @@ var f=document.createElement("iframe");
 f.src=src;
 f.setAttribute("loading","lazy");
 f.setAttribute("referrerpolicy","strict-origin-when-cross-origin");
-f.setAttribute("allow","accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share");
+f.setAttribute("allow",${JSON.stringify(EMBED_IFRAME_ALLOW)});
 f.setAttribute("allowfullscreen","");
-f.setAttribute("sandbox","allow-scripts allow-same-origin allow-presentation");
+f.setAttribute("sandbox",${JSON.stringify(EMBED_IFRAME_SANDBOX)});
 f.setAttribute("title",box.getAttribute("data-label")||"Embed");
 f.style.width="100%";
 f.style.aspectRatio="16/9";
 f.style.border="0";
 box.replaceWith(f);
 }
-function mountLink(box,src,label,kind){
-if(!allowedLink(src,kind))return;
+function mountLink(box,src,label){
+if(!allowedLink(src))return;
 var a=document.createElement("a");
 a.href=src;
 a.rel="noopener noreferrer nofollow";
@@ -1043,13 +1427,13 @@ if(loadBtn) loadBtn.textContent=C.ui.loadEmbed;
 if(!embedAllowed(st))return;
 var src=box.getAttribute("data-src")||"";
 var mode=box.getAttribute("data-mode")||"";
-var kind=box.getAttribute("data-emprivacy-embed")||"";
 if(mode==="iframe") mountIframe(box,src);
-else mountLink(box,src,box.getAttribute("data-label")||"",kind);
+else mountLink(box,src,box.getAttribute("data-label")||"");
 });
 }
 function persist(a,m,f,opts){
-var st={v:C.policyVersion,essential:true,functional:!!f,analytics:!!a,marketing:!!m};
+if(gpcOn())m=false;
+var st={v:C.policyVersion,essential:true,functional:!!f,analytics:!!a,marketing:!!m,gpc:gpcOn()};
 writeCookie(JSON.stringify({v:st.v,a:st.analytics?1:0,m:st.marketing?1:0,f:st.functional?1:0}));
 logServer(st);
 gtagUpdate(st);
@@ -1163,18 +1547,52 @@ ic.appendChild(document.createTextNode("🍪"));
 trigger.appendChild(ic);
 function showTrigger(){trigger.removeAttribute("hidden");}
 function hideTrigger(){trigger.setAttribute("hidden","");}
+function focusables(bar){
+return Array.prototype.filter.call(bar.querySelectorAll("a[href],button:not([disabled]),input:not([disabled]),summary"),function(el){
+return !el.closest("[hidden]");
+});
+}
+function bindDialog(bar,isReopen){
+bar.tabIndex=-1;
+function closeReopen(){
+if(bar.parentNode)bar.parentNode.removeChild(bar);
+showTrigger();
+try{trigger.focus();}catch(e){}
+}
+bar.addEventListener("keydown",function(ev){
+if(ev.key==="Escape"){
+if(!isReopen)return;
+ev.preventDefault();
+closeReopen();
+return;
+}
+if(ev.key!=="Tab")return;
+var nodes=focusables(bar);
+if(!nodes.length){ev.preventDefault();return;}
+var first=nodes[0],last=nodes[nodes.length-1],active=document.activeElement;
+if(ev.shiftKey){
+if(active===first||active===bar){ev.preventDefault();last.focus();}
+}else if(active===last){
+ev.preventDefault();first.focus();
+}
+});
+if(isReopen) bar.__emprivacyClose=closeReopen;
+try{bar.focus();}catch(e){}
+}
 function buildPanel(isReopen,hint){
 var st=parseState(readCookie());
 var aOn=st?!!st.analytics:(C.strictDefaults?false:true);
-var mOn=st?!!st.marketing:(C.strictDefaults?false:true);
+var mOn=gpcOn()?false:(st?!!st.marketing:(C.strictDefaults?false:true));
 var fOn=st?!!st.functional:(C.strictDefaults?false:true);
 if(isReopen) hideTrigger();
 var bar=document.createElement("div");
-bar.className="emprivacy-bar"+(isReopen?" emprivacy-bar--reopen":"");
+bar.className="emprivacy-bar"+(C.bannerPosition==="top"?" emprivacy-bar--top":"")+(isReopen?" emprivacy-bar--reopen":"");
 bar.setAttribute("role","dialog");
 bar.setAttribute("aria-modal",isReopen?"true":"false");
 var title=document.createElement("h2");
+title.id=isReopen?"emprivacy-reopen-title":"emprivacy-banner-title";
 title.className="emprivacy-title";
+bar.setAttribute("aria-labelledby",title.id);
 title.appendChild(document.createTextNode(C.bannerTitle));
 var msg=document.createElement("p");
 msg.className="emprivacy-msg";
@@ -1199,6 +1617,7 @@ note.appendChild(document.createTextNode(C.ui.essentialNote));
 var fr=mkRow(C.ui.functional,isReopen?"emprivacy-rf":"emprivacy-f",fOn,false);
 var er=mkRow(C.ui.analytics,isReopen?"emprivacy-ra":"emprivacy-a",aOn,false);
 var mr=mkRow(C.ui.marketing,isReopen?"emprivacy-rm":"emprivacy-m",mOn,false);
+if(gpcOn()){mr.box.checked=false;mr.box.disabled=true;}
 opts.appendChild(ess.wrap);
 opts.appendChild(note);
 opts.appendChild(fr.wrap);
@@ -1238,14 +1657,21 @@ btnClose.type="button";
 btnClose.className="emprivacy-btn";
 btnClose.appendChild(document.createTextNode(C.ui.close));
 btnClose.addEventListener("click",function(){
-if(bar.parentNode)bar.parentNode.removeChild(bar);
-showTrigger();
+if(typeof bar.__emprivacyClose==="function")bar.__emprivacyClose();
 });
 actions.appendChild(btnClose);
 }
 actions.appendChild(btnSave);
 bar.appendChild(title);
 bar.appendChild(msg);
+if(gpcOn()){
+var gpcEl=document.createElement("p");
+gpcEl.className="emprivacy-note";
+gpcEl.id=isReopen?"emprivacy-gpc-reopen":"emprivacy-gpc-note";
+gpcEl.appendChild(document.createTextNode(C.ui.gpcNote||""));
+bar.appendChild(gpcEl);
+bar.setAttribute("aria-describedby",gpcEl.id);
+}
 bar.appendChild(links);
 bar.appendChild(opts);
 bar.appendChild(actions);
@@ -1255,7 +1681,9 @@ function openReopenPanel(hint){
 if(root.querySelector(".emprivacy-bar--reopen"))return;
 var st=parseState(readCookie());
 if(!st)return;
-root.appendChild(buildPanel(true,hint||""));
+var panel=buildPanel(true,hint||"");
+root.appendChild(panel);
+bindDialog(panel,true);
 }
 openPanel=function(hint){
 var st=parseState(readCookie());
@@ -1270,7 +1698,7 @@ note.appendChild(document.createTextNode(hint));
 var opts=existing.querySelector(".emprivacy-opts");
 if(opts){opts.insertBefore(note,opts.firstChild);show(opts);}
 }
-try{existing.scrollIntoView({block:"end"});}catch(e){}
+try{existing.scrollIntoView({block:C.bannerPosition==="top"?"start":"end"});}catch(e){}
 }
 }
 };
@@ -1294,18 +1722,21 @@ openPanel(C.ui.embedNeedConsent);
 }
 wireEmbedButtons();
 if(!needBanner()){
-var st=parseState(readCookie());
+var st=currentState();
 if(st){
 applyScripts(st);
 gtagUpdate(st);
 hydrateEmbeds(st);
-}
+}else purgeDenied(deniedState());
 showTrigger();
 trigger.addEventListener("click",function(){openReopenPanel();});
 installApi();
 return;
 }
-root.appendChild(buildPanel(false,""));
+purgeDenied(deniedState());
+var first=buildPanel(false,"");
+root.appendChild(first);
+bindDialog(first,false);
 trigger.addEventListener("click",function(){openReopenPanel();});
 installApi();
 }
@@ -1316,6 +1747,11 @@ else mount();
 function buildGoogleConsentHeadScript() {
 	return `(function(){window.dataLayer=window.dataLayer||[];function g(){window.dataLayer.push(arguments);}window.gtag=g;g("consent","default",{"analytics_storage":"denied","ad_storage":"denied","ad_user_data":"denied","ad_personalization":"denied","functionality_storage":"denied","security_storage":"granted","personalization_storage":"denied"});})();`;
 }
+/** Denied-by-default Microsoft signals. The tag itself loads only after the matching category is allowed. */
+function buildMicrosoftConsentHeadScript(kind) {
+	if (kind === "clarity") return `(function(){window.clarity=window.clarity||function(){(window.clarity.q=window.clarity.q||[]).push(arguments);};window.clarity("consentv2",{"ad_Storage":"denied","analytics_Storage":"denied"});})();`;
+	return `(function(){window.uetq=window.uetq||[];window.uetq.push("consent","default",{"ad_storage":"denied"});})();`;
+}
 //#endregion
 //#region src/vendors.ts
 const PLAUSIBLE_SCRIPT = "https://plausible.io/js/script.js";
@@ -1328,13 +1764,16 @@ function buildAnalyticsLoader(cfg) {
 			type: "cloudflare",
 			token: cfg.cloudflareWebAnalyticsToken
 		} : { type: "none" };
-		case "custom": return cfg.analyticsScriptUrls.length ? {
-			type: "custom",
-			scripts: cfg.analyticsScriptUrls.map((src) => ({
+		case "custom": {
+			const scripts = cfg.analyticsScriptUrls.filter((src) => isPublishableCustomScript(src, cfg.scriptIntegrity[src], cfg.scriptHostAllowlist)).map((src) => ({
 				src,
 				integrity: cfg.scriptIntegrity[src] ?? null
-			}))
-		} : { type: "none" };
+			}));
+			return scripts.length ? {
+				type: "custom",
+				scripts
+			} : { type: "none" };
+		}
 		case "plausible": return isHostname$1(cfg.analyticsId) ? {
 			type: "plausible",
 			src: PLAUSIBLE_SCRIPT,
@@ -1345,7 +1784,10 @@ function buildAnalyticsLoader(cfg) {
 			src: FATHOM_SCRIPT,
 			siteId: cfg.analyticsId.trim()
 		} : { type: "none" };
-		case "umami": return isUmamiId(cfg.analyticsId) && cfg.umamiScriptUrl ? {
+		case "umami": return isUmamiId(cfg.analyticsId) && cfg.umamiScriptUrl && isScriptHostAllowed(cfg.umamiScriptUrl, {
+			allowlist: cfg.scriptHostAllowlist,
+			allowPresets: false
+		}) ? {
 			type: "umami",
 			src: cfg.umamiScriptUrl,
 			websiteId: cfg.analyticsId.trim()
@@ -1362,6 +1804,14 @@ function buildAnalyticsLoader(cfg) {
 			type: "gtm",
 			containerId: cfg.analyticsId.trim()
 		} : { type: "none" };
+		case "clarity": return isClarityId(cfg.analyticsId) ? {
+			type: "clarity",
+			projectId: cfg.analyticsId.trim()
+		} : { type: "none" };
+		case "uet": return isUetId(cfg.analyticsId) ? {
+			type: "uet",
+			tagId: cfg.analyticsId.trim()
+		} : { type: "none" };
 		default: return { type: "none" };
 	}
 }
@@ -1428,6 +1878,20 @@ function buildVendorList(cfg) {
 		purpose: "Loads GTM only after Marketing consent (containers often fire ads/remarketing). You remain responsible for tags inside the container.",
 		policyUrl: "https://policies.google.com/privacy"
 	});
+	else if (loader.type === "clarity") rows.push({
+		id: "clarity",
+		name: "Microsoft Clarity",
+		category: "analytics",
+		purpose: "Clarity loads only after Analytics consent. Advertising storage stays denied until Marketing is also allowed. The project ID is not shown here.",
+		policyUrl: "https://www.microsoft.com/privacy"
+	});
+	else if (loader.type === "uet") rows.push({
+		id: "uet",
+		name: "Microsoft Advertising (UET)",
+		category: "marketing",
+		purpose: "The UET tag loads only after Marketing consent. Until then, advertising storage stays denied and the tag is not injected.",
+		policyUrl: "https://www.microsoft.com/privacy"
+	});
 	else if (loader.type === "custom") for (const [i, script] of loader.scripts.entries()) {
 		let host = "custom script";
 		try {
@@ -1463,11 +1927,13 @@ function buildVendorList(cfg) {
 }
 //#endregion
 //#region src/version.ts
-const VERSION = "3.0.0";
+const VERSION = "3.2.0";
 //#endregion
 //#region src/runtime.ts
-/** Soft cap for anonymous consent POSTs per client fingerprint per UTC hour. */
+/** Soft cap for anonymous consent POSTs per trusted client address per UTC hour. */
 const RECORD_RATE_LIMIT = 30;
+/** Site-wide cap so one client cannot fill the consent log in a single hour. */
+const RECORD_GLOBAL_LIMIT = 60;
 const RECORD_LOG_CAP = 500;
 const ADMIN_SETTINGS_PATH = "/settings";
 const SAVE_ACTION_ID = "emprivacy-save";
@@ -1475,8 +1941,10 @@ const recordInput = z.object({
 	policyVersion: z.string().trim().min(1).max(64),
 	functional: z.boolean(),
 	analytics: z.boolean(),
-	marketing: z.boolean()
+	marketing: z.boolean(),
+	gpc: z.boolean().optional()
 });
+const EXPORT_PATH = `/_emdash/api/plugins/${PLUGIN_ID}/consent-export`;
 async function loadConfig(ctx) {
 	const raw = await ctx.kv.get(KV_KEY);
 	if (!raw) return normalizeConfig({});
@@ -1502,28 +1970,17 @@ function absolutePolicyHref(stored, ctx) {
 		return null;
 	}
 }
-function clientFingerKey(request) {
-	const cf = request.headers.get("cf-connecting-ip")?.trim();
-	const xff = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim();
-	const ua = (request.headers.get("user-agent") ?? "").slice(0, 120);
-	return `${cf || xff || "unknown"}|${ua}`;
-}
 async function hashFinger(s) {
 	const data = new TextEncoder().encode(`emprivacy-rl:${s}`);
 	const dig = await crypto.subtle.digest("SHA-256", data);
 	return Array.from(new Uint8Array(dig)).map((b) => b.toString(16).padStart(2, "0")).join("").slice(0, 32);
 }
-async function allowRecordWrite(ctx, request) {
-	const key = `consent:rl:${rateHourKey()}:${await hashFinger(clientFingerKey(request))}`;
-	try {
-		const raw = await ctx.kv.get(key);
-		const n = raw && /^\d{1,6}$/.test(raw) ? Number(raw) : 0;
-		if (n >= RECORD_RATE_LIMIT) return false;
-		await ctx.kv.set(key, String(n + 1));
-		return true;
-	} catch {
-		return false;
-	}
+async function allowRecordWrite(ctx) {
+	const hour = rateHourKey();
+	const ip = ctx.requestMeta?.ip?.trim() ?? "";
+	const bucket = ip ? `ip:${await hashFinger(ip)}` : "untrusted";
+	if (!await tryConsumeRateSlot(ctx.kv, `consent:rl:${hour}:global`, RECORD_GLOBAL_LIMIT)) return false;
+	return tryConsumeRateSlot(ctx.kv, `consent:rl:${hour}:${bucket}`, RECORD_RATE_LIMIT);
 }
 function publicRuntime(cfg, ctx, page) {
 	const copy = resolvePublicCopy(cfg, page.locale);
@@ -1541,14 +1998,16 @@ function publicRuntime(cfg, ctx, page) {
 		embedCategory: cfg.embedCategory,
 		gateEmbeds: cfg.gateEmbeds,
 		hideBanner,
+		bannerPosition: cfg.bannerPosition,
 		theme: cfg.theme,
 		ui: copy.ui,
 		loader: buildAnalyticsLoader(cfg),
-		marketingScripts: cfg.marketingScriptUrls.map((src) => ({
+		marketingScripts: cfg.marketingScriptUrls.filter((src) => isPublishableCustomScript(src, cfg.scriptIntegrity[src], cfg.scriptHostAllowlist)).map((src) => ({
 			src,
 			integrity: cfg.scriptIntegrity[src] ?? null
 		})),
 		scriptHostAllowlist: cfg.scriptHostAllowlist,
+		embedHostAllowlist: cfg.embedHostAllowlist,
 		scriptIntegrity: cfg.scriptIntegrity,
 		cookieMaxAge: cookieMaxAgeSeconds(cfg.cookieMaxAgeDays),
 		vendors: buildVendorList(cfg)
@@ -1556,8 +2015,9 @@ function publicRuntime(cfg, ctx, page) {
 }
 function themeStyle() {
 	return `<style id="emprivacy-style">
-#emprivacy-root{font-family:system-ui,sans-serif;font-size:14px;--emprivacy-bg:#111111;--emprivacy-text:#eeeeee;--emprivacy-accent:#3b82f6;--emprivacy-radius:6px}
-.emprivacy-bar{position:fixed;z-index:99999;left:0;right:0;bottom:0;background:var(--emprivacy-bg);color:var(--emprivacy-text);padding:16px 20px 20px;box-shadow:0 -4px 24px rgba(0,0,0,.25);max-height:45vh;overflow:auto}
+#emprivacy-root{font-family:system-ui,sans-serif;font-size:14px;--emprivacy-bg:#0f172a;--emprivacy-text:#f8fafc;--emprivacy-accent:#3b82f6;--emprivacy-radius:8px}
+.emprivacy-bar{position:fixed;z-index:99999;inset-inline:0;bottom:0;background:var(--emprivacy-bg);color:var(--emprivacy-text);padding:16px 20px max(20px, env(safe-area-inset-bottom));box-shadow:0 -4px 24px rgba(0,0,0,.25);max-height:min(45vh, 100dvh);overflow:auto}
+.emprivacy-bar--top{top:0;bottom:auto;padding:max(16px, env(safe-area-inset-top)) 20px 16px;box-shadow:0 4px 24px rgba(0,0,0,.25)}
 .emprivacy-title{margin:0 0 8px;font-size:1.1rem}
 .emprivacy-msg,.emprivacy-note{margin:0 0 10px;line-height:1.4;opacity:.95}
 .emprivacy-note{font-size:.85rem}
@@ -1566,6 +2026,8 @@ function themeStyle() {
 .emprivacy-switch{display:block;margin:6px 0}
 .emprivacy-actions{display:flex;flex-wrap:wrap;gap:8px;margin-top:10px}
 .emprivacy-btn{border-radius:var(--emprivacy-radius);border:1px solid color-mix(in srgb,var(--emprivacy-text) 35%,transparent);background:transparent;color:var(--emprivacy-text);padding:8px 12px;cursor:pointer}
+.emprivacy-btn:focus-visible,.emprivacy-switch input:focus-visible,.emprivacy-links a:focus-visible,.emprivacy-vendors summary:focus-visible,.emprivacy-bar:focus-visible{outline:2px solid var(--emprivacy-accent);outline-offset:2px}
+.emprivacy-btn-primary:focus-visible{outline-color:#fff}
 .emprivacy-btn-primary{background:var(--emprivacy-accent);border-color:var(--emprivacy-accent);color:#fff}
 .emprivacy-cookie-trigger{position:fixed;z-index:99998;left:16px;bottom:16px;width:48px;height:48px;border-radius:50%;border:1px solid color-mix(in srgb,var(--emprivacy-text) 35%,transparent);background:var(--emprivacy-bg);color:var(--emprivacy-text);box-shadow:0 2px 12px rgba(0,0,0,.2);cursor:pointer;padding:0;display:flex;align-items:center;justify-content:center}
 .emprivacy-cookie-trigger:hover{filter:brightness(1.1)}
@@ -1636,6 +2098,12 @@ function createPlugin() {
 					key: "emprivacy:gcm-default",
 					code: buildGoogleConsentHeadScript()
 				});
+				if (cfg.analyticsProvider === "clarity" || cfg.analyticsProvider === "uet") headScripts.push({
+					kind: "inline-script",
+					placement: "head",
+					key: "emprivacy:ms-consent-default",
+					code: buildMicrosoftConsentHeadScript(cfg.analyticsProvider)
+				});
 				const boot = {
 					kind: "inline-script",
 					placement: "body:end",
@@ -1652,6 +2120,7 @@ function createPlugin() {
 		},
 		routes: {
 			admin: { handler: async (ctx) => {
+				if (!ctx.user) return new Response("unauthorized", { status: 401 });
 				const interaction = ctx.input;
 				if (interaction?.type === "page_load" && interaction.page === ADMIN_SETTINGS_PATH) return buildSettingsPage(ctx);
 				if (interaction?.type === "form_submit" && interaction.action_id === SAVE_ACTION_ID) {
@@ -1677,12 +2146,15 @@ function createPlugin() {
 							analyticsUrlsText: String(v.analytics_urls ?? ""),
 							marketingUrlsText: String(v.marketing_urls ?? ""),
 							scriptHostAllowlistText: String(v.script_host_allowlist ?? ""),
+							embedHostAllowlistText: String(v.embed_host_allowlist ?? ""),
 							cookieMaxAgeDays: String(v.cookie_max_age_days ?? "180"),
 							googleConsentMode: asBool(v.google_cm),
 							logConsentToServer: asBool(v.log_server),
 							embedCategory: String(v.embed_category ?? "marketing"),
 							gateEmbeds: asBool(v.gate_embeds),
 							hideBannerOnPolicyPages: asBool(v.hide_on_policy),
+							bannerPosition: String(v.banner_position ?? "bottom"),
+							themeProfile: String(v.theme_profile ?? "slate"),
 							defaultLocale: String(v.default_locale ?? "en"),
 							localeOverridesText: String(v.locale_overrides ?? ""),
 							themeBg: String(v.theme_bg ?? ""),
@@ -1732,13 +2204,15 @@ function createPlugin() {
 					};
 					const input = ctx.input;
 					if (input.policyVersion !== cfg.policyVersion) return new Response("policy_version_mismatch", { status: 400 });
-					if (!await allowRecordWrite(ctx, ctx.request)) return new Response("rate_limited", { status: 429 });
+					if (!await allowRecordWrite(ctx)) return new Response("rate_limited", { status: 429 });
+					const gpc = input.gpc === true;
 					const row = {
 						createdAt: (/* @__PURE__ */ new Date()).toISOString(),
 						policyVersion: input.policyVersion,
 						functional: input.functional,
 						analytics: input.analytics,
-						marketing: input.marketing
+						marketing: gpc ? false : input.marketing,
+						...gpc ? { gpc: true } : {}
 					};
 					try {
 						if ((await ctx.storage.consentEvents.query({
@@ -1758,6 +2232,29 @@ function createPlugin() {
 					return { ok: true };
 				}
 			},
+			"consent-export": { handler: async (ctx) => {
+				if (ctx.request.method !== "GET") return new Response("method_not_allowed", { status: 405 });
+				if (!ctx.user) return new Response("unauthorized", { status: 401 });
+				let rows = [];
+				try {
+					rows = (await ctx.storage.consentEvents.query({
+						orderBy: { createdAt: "desc" },
+						limit: RECORD_LOG_CAP
+					})).items.map((item) => item.data);
+				} catch {
+					return new Response("export_unavailable", { status: 503 });
+				}
+				const body = buildConsentCsv(rows);
+				return new Response(body, {
+					status: 200,
+					headers: {
+						"Content-Type": "text/csv; charset=utf-8",
+						"Content-Disposition": "attachment; filename=\"emprivacy-consent.csv\"",
+						"Cache-Control": "private, no-store",
+						"X-Content-Type-Options": "nosniff"
+					}
+				});
+			} },
 			vendors: {
 				public: true,
 				handler: async (ctx) => {
@@ -1770,7 +2267,7 @@ function createPlugin() {
 }
 async function buildSettingsPage(ctx) {
 	const [cfg, latestPublished] = await Promise.all([loadConfig(ctx), fetchLatestPublishedVersion({ fetch: ctx.http?.fetch ?? globalThis.fetch })]);
-	const installedVersion = ctx.plugin?.version ?? "3.0.0";
+	const installedVersion = ctx.plugin?.version ?? "3.2.0";
 	const analyticsText = cfg.analyticsScriptUrls.map((src) => {
 		const i = cfg.scriptIntegrity[src];
 		return i ? `${src} ${i}` : src;
@@ -1794,9 +2291,10 @@ async function buildSettingsPage(ctx) {
 			})).items.map((item) => {
 				const d = item.data;
 				const functional = typeof d.functional === "boolean" ? ` · functional ${d.functional ? "on" : "off"}` : "";
+				const gpc = d.gpc === true ? " · GPC" : "";
 				return {
 					label: d.createdAt,
-					value: `policy ${d.policyVersion}${functional} · analytics ${d.analytics ? "on" : "off"} · marketing ${d.marketing ? "on" : "off"}`
+					value: `policy ${d.policyVersion}${functional} · analytics ${d.analytics ? "on" : "off"} · marketing ${d.marketing ? "on" : "off"}${gpc}`
 				};
 			});
 		} catch {
@@ -1893,6 +2391,19 @@ async function buildSettingsPage(ctx) {
 					label: "Hide the first-visit banner on privacy and cookie policy pages",
 					initial_value: cfg.hideBannerOnPolicyPages
 				},
+				{
+					type: "radio",
+					action_id: "banner_position",
+					label: "Banner position",
+					options: [{
+						value: "bottom",
+						label: "Bottom of the viewport"
+					}, {
+						value: "top",
+						label: "Top of the viewport"
+					}],
+					initial_value: cfg.bannerPosition
+				},
 				{
 					type: "radio",
 					action_id: "analytics_platform",
@@ -1926,6 +2437,14 @@ async function buildSettingsPage(ctx) {
 							value: "gtm",
 							label: "Google Tag Manager (requires Marketing consent)"
 						},
+						{
+							value: "clarity",
+							label: "Microsoft Clarity (requires Analytics consent)"
+						},
+						{
+							value: "uet",
+							label: "Microsoft UET (requires Marketing consent)"
+						},
 						{
 							value: "none",
 							label: "None"
@@ -1951,8 +2470,8 @@ async function buildSettingsPage(ctx) {
 				{
 					type: "text_input",
 					action_id: "analytics_id",
-					label: "Analytics ID (domain, site ID, G-…, or GTM-…)",
-					placeholder: "example.com / G-XXXX / GTM-XXXX",
+					label: "Analytics ID (domain, site ID, G-…, GTM-…, Clarity project ID, or UET tag ID)",
+					placeholder: "example.com / G-XXXX / GTM-XXXX / Clarity ID / UET digits",
 					initial_value: cfg.analyticsId
 				},
 				{
@@ -1969,7 +2488,7 @@ async function buildSettingsPage(ctx) {
 				{
 					type: "text_input",
 					action_id: "analytics_urls",
-					label: "Custom analytics script URLs (one https URL per line; optional trailing SRI: … sha384-…)",
+					label: "Custom analytics script URLs (one https URL per line, SRI required: … sha384-…)",
 					placeholder: "https://cdn.example/a.js sha384-…",
 					multiline: true,
 					initial_value: analyticsText,
@@ -1981,7 +2500,7 @@ async function buildSettingsPage(ctx) {
 				{
 					type: "text_input",
 					action_id: "marketing_urls",
-					label: "Marketing script URLs (one https URL per line; optional trailing SRI: … sha384-…)",
+					label: "Marketing script URLs (one https URL per line, SRI required: … sha384-…)",
 					placeholder: "https://… (one per line)",
 					multiline: true,
 					initial_value: marketingText
@@ -1989,11 +2508,19 @@ async function buildSettingsPage(ctx) {
 				{
 					type: "text_input",
 					action_id: "script_host_allowlist",
-					label: "Script host allowlist (optional; one hostname per line). When set, Custom analytics and marketing URLs must match.",
+					label: "Script host allowlist (required for Custom, Umami, and marketing URLs; one hostname per line)",
 					placeholder: "cdn.example.com\njs.stripe.com",
 					multiline: true,
 					initial_value: cfg.scriptHostAllowlist.join("\n")
 				},
+				{
+					type: "text_input",
+					action_id: "embed_host_allowlist",
+					label: "Embed link hosts (one hostname per line). Mastodon and link previews become links only when listed. X, Bluesky, Gist, YouTube, and Vimeo stay built in.",
+					placeholder: "mastodon.social\nexample.com",
+					multiline: true,
+					initial_value: cfg.embedHostAllowlist.join("\n")
+				},
 				{
 					type: "text_input",
 					action_id: "cookie_max_age_days",
@@ -2026,32 +2553,80 @@ async function buildSettingsPage(ctx) {
 					}],
 					initial_value: cfg.embedCategory
 				},
+				{
+					type: "radio",
+					action_id: "theme_profile",
+					label: "Banner theme",
+					options: [
+						{
+							value: "slate",
+							label: "Slate"
+						},
+						{
+							value: "paper",
+							label: "Paper"
+						},
+						{
+							value: "ink",
+							label: "Ink"
+						},
+						{
+							value: "indigo",
+							label: "Indigo"
+						},
+						{
+							value: "primer",
+							label: "Primer"
+						},
+						{
+							value: "custom",
+							label: "Custom colors"
+						}
+					],
+					initial_value: cfg.themeProfile
+				},
 				{
 					type: "text_input",
 					action_id: "theme_bg",
 					label: "Banner background (hex)",
-					placeholder: "#111111",
-					initial_value: cfg.theme.bg
+					placeholder: "#0f172a",
+					initial_value: cfg.theme.bg,
+					condition: {
+						field: "theme_profile",
+						eq: "custom"
+					}
 				},
 				{
 					type: "text_input",
 					action_id: "theme_text",
 					label: "Banner text (hex)",
-					placeholder: "#eeeeee",
-					initial_value: cfg.theme.text
+					placeholder: "#f8fafc",
+					initial_value: cfg.theme.text,
+					condition: {
+						field: "theme_profile",
+						eq: "custom"
+					}
 				},
 				{
 					type: "text_input",
 					action_id: "theme_accent",
 					label: "Banner accent (hex)",
 					placeholder: "#3b82f6",
-					initial_value: cfg.theme.accent
+					initial_value: cfg.theme.accent,
+					condition: {
+						field: "theme_profile",
+						eq: "custom"
+					}
 				},
 				{
 					type: "text_input",
 					action_id: "theme_radius",
 					label: "Banner corner radius (0–24 px)",
-					placeholder: "6",
+					condition: {
+						field: "theme_profile",
+						eq: "custom"
+					},
+					placeholder: "8",
 					initial_value: String(cfg.theme.radiusPx)
 				},
 				{
@@ -2079,16 +2654,20 @@ async function buildSettingsPage(ctx) {
 			type: "fields",
 			fields: vendorFields
 		},
-		...cfg.logConsentToServer && consentFields.length > 0 ? [
+		...cfg.logConsentToServer ? [
 			{ type: "divider" },
 			{
 				type: "header",
 				text: "Recent consent records"
 			},
 			{
+				type: "context",
+				text: `Download the log (up to ${RECORD_LOG_CAP} rows, no IP): ${EXPORT_PATH}. Signed-in admins only. Cells that start with = + - or @ are prefixed so a spreadsheet does not treat them as formulas.`
+			},
+			...consentFields.length > 0 ? [{
 				type: "fields",
 				fields: consentFields
-			}
+			}] : []
 		] : []
 	] };
 }
@@ -2141,22 +2720,9 @@ const POSTER_HOSTS = /* @__PURE__ */ new Set([
 	"img.youtube.com",
 	"i.vimeocdn.com"
 ]);
-function hasUnsafeChars(s) {
-	return /[\u0000-\u001F\u007F\s]/.test(s);
-}
+/** Same non-public host rules as script URLs. */
 function parseHttpsUrl(raw) {
-	const t = raw.trim();
-	if (!t || t.length > 2048 || hasUnsafeChars(t)) return null;
-	if (/%0d|%0a|%09|%0b|%0c|%20/i.test(t)) return null;
-	try {
-		const u = new URL(t);
-		if (u.protocol !== "https:") return null;
-		if (u.username || u.password) return null;
-		if (u.hostname === "localhost" || u.hostname.endsWith(".localhost")) return null;
-		return u;
-	} catch {
-		return null;
-	}
+	return parseStrictHttpsUrl(raw);
 }
 function hostOf(u) {
 	return u.hostname.toLowerCase();