@escape-game-over/atlas 0.1.43 → 0.1.45

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@escape-game-over/atlas",
-    "version": "0.1.43",
+    "version": "0.1.45",
     "type": "module",
     "description": "Typed, data-driven machinery for static multi-locale, multi-deployment Astro sites.",
     "private": false,

package/src/analytics/google.ts

@@ -345,7 +345,7 @@ export function googleEmits(
 }
 
 /**
- * Google's tags: a connection and one inline block and the loader in the head,
+ * Google's tags: a connection and one inline block in the head,
  * Tag Manager's `<noscript>` fallback in the body.
  *
  * One block rather than several because `dataLayer` is a queue — consent, the
@@ -424,6 +424,7 @@ export function googleScripts(
             : "",
         tags.length > 0 ? "gtag('js',new Date());" : "",
         ...tags.map((id) => `gtag('config',${literal(id)});`),
+        loader(tags[0]),
         // Tag Manager's own loader, once per container. It appends its script
         // itself, so it runs after the consent calls already queued above.
         ...containers.map(
@@ -432,35 +433,14 @@ export function googleScripts(
         ),
     ].join("");
 
-    // The library is fetched once, for the first id, and every id gets its own
-    // `config` above. That is Google's documented arrangement rather than a
-    // shortcut: *"A single Google tag can have multiple tag IDs"*, and their
-    // own example loads `gtag/js?id=G-XXXXXX` once and then configures
-    // `GT-XXXXXX` and `DC-ZZZZZZ` against it. The `?id=` only bootstraps the
-    // library; the `config` calls are what register a destination.
-    //
-    // Loading it per id would fetch the same script several times and re-run
-    // its bootstrap — more bytes for nothing, and a second copy of a global.
-    //
-    // <https://developers.google.com/tag-platform/gtagjs/configure>
-    const first = tags[0];
     return {
         head: [
             // Ahead of the inline block, which is the only position that buys
-            // anything: for a container the loader's URL is written *by* that
-            // block, so this is the only mention of the origin the browser can
-            // act on before the script has run.
+            // anything: both loaders' URLs are written *by* that block, so this
+            // is the only mention of the origin the browser can act on before
+            // the script has run.
             preconnect(TAG_ORIGIN),
             { kind: "script", content: inline },
-            ...(first === undefined
-                ? []
-                : [
-                      {
-                          kind: "externalScript" as const,
-                          src: `${TAG_ORIGIN}/gtag/js?id=${encodeURIComponent(first)}`,
-                          attrs: {},
-                      },
-                  ]),
         ],
         // One per container, and only for Tag Manager: GA4 has no such
         // fallback, because `gtag.js` is the only way it collects anything.
@@ -470,3 +450,31 @@ export function googleScripts(
         })),
     };
 }
+
+/**
+ * `gtag.js`, appended once the page has loaded.
+ *
+ * Its parse and first run — including a forced reflow of its own — otherwise
+ * compete with the page for the load window. Nothing is lost by waiting:
+ * `dataLayer` is a queue, and every call above is replayed when it arrives.
+ * What waiting costs is a visitor who leaves before `load`, who is not counted.
+ *
+ * The library is fetched once, for the first id, and every id gets its own
+ * `config` above. That is Google's documented arrangement rather than a
+ * shortcut: *"A single Google tag can have multiple tag IDs"*, and their
+ * own example loads `gtag/js?id=G-XXXXXX` once and then configures
+ * `GT-XXXXXX` and `DC-ZZZZZZ` against it. The `?id=` only bootstraps the
+ * library; the `config` calls are what register a destination.
+ *
+ * Loading it per id would fetch the same script several times and re-run
+ * its bootstrap — more bytes for nothing, and a second copy of a global.
+ *
+ * <https://developers.google.com/tag-platform/gtagjs/configure>
+ */
+function loader(first: string | undefined): string {
+    if (first === undefined) return "";
+    const src = literal(
+        `${TAG_ORIGIN}/gtag/js?id=${encodeURIComponent(first)}`
+    );
+    return `(function(){function l(){var s=document.createElement('script');s.async=true;s.src=${src};document.head.appendChild(s)}document.readyState==='complete'?l():addEventListener('load',l)})();`;
+}

package/src/astro/attribution.ts

@@ -11,7 +11,8 @@
  * - **Campaign tags** (`utm_*`) are labels a campaign shares with everyone who
  *   clicked it, not an identifier. They are kept for the tab in
  *   `sessionStorage`, so a visitor who lands on one page and fills a form on
- *   another still reports them. `rememberCampaign()` on every page does that.
+ *   another still reports them. `rememberCampaign()` does that; `Document`'s
+ *   `rememberCampaign` runs it on every page, with analytics consent only.
  * - **The ad click id** (`gclid`, `gbraid`, `wbraid`) identifies one click, and
  *   is never stored here. Google keeps it under the visitor's consent: on the
  *   URL while marketing is denied — `urlPassthrough` in `GoogleSettings` — and

package/src/astro/consent.ts

@@ -80,8 +80,15 @@ export function readConsent(): ConsentRecord | undefined {
 }
 
 /**
- * Remembers an answer, dated now, and tells Google about it — one call, so the
- * two cannot come apart.
+ * The event `recordConsent` fires on `window` with the new answer as `detail`,
+ * for anything on the page that waits on a category — without the banner
+ * having to know it exists.
+ */
+export const CONSENT_EVENT = "atlas:consent";
+
+/**
+ * Remembers an answer, dated now, tells Google about it, and announces it — one
+ * call, so the three cannot come apart.
  */
 export function recordConsent(choices: ConsentChoices): void {
     const record: ConsentRecord = { ...choices, at: new Date().toISOString() };
@@ -92,6 +99,9 @@ export function recordConsent(choices: ConsentChoices): void {
         // one — the choice still applies to this page.
     }
     applyConsent(choices);
+    window.dispatchEvent?.(
+        new CustomEvent<ConsentChoices>(CONSENT_EVENT, { detail: choices })
+    );
 }
 
 /**

package/src/astro/remember-campaign.ts

@@ -1,4 +1,15 @@
 // Every page: a visit can land anywhere before it reaches a form.
+//
+// Only with analytics consent. Keeping campaign tags is measurement, and EU
+// rules ask consent for anything stored on a visitor's device that the site
+// does not need to work — not only cookies. So the tags are kept now if the
+// visitor already agreed, or the moment they agree on this page.
 import { rememberCampaign } from "./attribution.ts";
+import { CONSENT_EVENT, type ConsentChoices, readConsent } from "./consent.ts";
 
-rememberCampaign();
+if (readConsent()?.analytics === "granted") rememberCampaign();
+
+addEventListener(CONSENT_EVENT, (event) => {
+    const choices = (event as CustomEvent<ConsentChoices>).detail;
+    if (choices.analytics === "granted") rememberCampaign();
+});

package/src/index.ts

@@ -14,6 +14,7 @@
 
 export {
     CONSENT_CATEGORIES,
+    CONSENT_MONTHS,
     type ConsentCategory,
     type ConsentChoice,
     type ConsentChoices,