@getquick/content 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,143 @@
-# Temporary Holding Version
+# @getquick/content
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The configured content runtime for WordPress HTML and WPGraphQL. This slice
+provides pure helpers, the configured WordPress client, durable delivery and
+installed SQL migrations, and event/refresh HTTP handlers. This is not a
+completed or published 0.1.0 release pair.
+
+```ts
+import { renderWordPressBlocks, htmlLang } from "@getquick/content";
+import { createContentRuntime } from "@getquick/content/server";
+
+const content = createContentRuntime({
+  site: "my Site identity",
+  graphqlEndpoint: "https://cms.example.test/wp/graphql",
+  cmsOrigin: "https://cms.example.test",
+  wordpress: {
+    locale: "pt_PT_ao90",
+    languages: [{ locale: "en_US", slug: "en" }],
+  },
+  isServer: () => true, // Supply the framework's lazy server-context check.
+  bindings: () => ({}), // Supply fresh request bindings, including optional credentials.
+});
+const home = await content.wordpress.getHomeContent(content.defaultLanguage);
+const entry = await content.wordpress.getEntryByUri("/about/");
+const chrome = await content.wordpress.getSiteChrome("https://www.example.test", {
+  language: content.routeLanguage("/en/about/"),
+});
+```
+
+The Site supplies all configuration: no manifest, framework environment or
+Cloudflare discovery is imported. Construct per request where practical. A
+long-lived instance calls its binding getter on every delivery operation and CMS request. Keep the
+GraphQL read identity separate from automation identities. Partial credential
+pairs fail before transport. With credentials, only the configured HTTPS CMS
+origin at `/graphql` or `/wp/graphql`, without URL userinfo, is allowed. Reads use
+manual redirects and an eight-second deadline; failed reads return unavailable,
+confirmed absence returns missing, and successful reads return found.
+
+The root entry contains pure helpers and public structural types. The server
+entry exports `createContentRuntime`, `ContentConfig`, `ContentBindings`,
+`ContentRuntime` and `WordPressClient`. Runtime properties contain languages,
+routing functions and the WordPress methods; credentials/configuration are kept
+in closures. Language configuration retains the source's normalization policy,
+and routing returns the same language objects held in that instance's array.
+
+The reusable client methods retain their argument order:
+
+- `getHomeContent(language?)`
+- `getEntryByUri(uri)`
+- `getDesignPresets()`
+- `getPublishedEntries()`
+- `getPublishedRoutes()`
+- `getSiteChrome(siteOrigin?, { location?, language? }?)`
+
+From the repository root, use `vp install` and `vp run validate`. Validation
+builds compiled ESM/declarations through Vite+ Pack, checks formatting/lint/types,
+runs package-boundary suites, then packs and installs in a disposable consumer
+without private registry configuration. `vp run test` rebuilds before tests;
+`vp test frontend/tests/wordpress-access.test.ts` is useful after an explicit
+`vp pack` during a focused implementation cycle. Build output is intentionally
+untracked. The npm tarball allowlist contains only compiled output, the five original SQL migrations, the
+separate consent database migrations and package metadata (npm also includes this README).
+
+The public delivery methods are `publishedHome(siteOrigin?, language?)`,
+`publishedEntry(path, siteOrigin?)` and `pageChrome(siteOrigin?)`. Supply a
+`PUBLICATION_DB` structural binding to serve durable publications. Stored reads
+need no event or refresh secret and retain last-known-good content without an
+age limit. Cold entry lookups read the CMS once, preserving missing versus
+unavailable, canonical routes, language isolation and conditional promotion.
+Production without a store returns unavailable (chrome returns null). Only
+`development: true` enables live reads without a store. A store failure never
+activates that fallback. All public reads guard server context before bindings
+or transport.
+
+Infrastructure imports the Node-only migration entry separately:
+
+```ts
+import { migrationsDirectory } from "@getquick/content/migrations";
+// Alchemy beta.79: Cloudflare.D1.Database("Publications", {
+//   migrations: migrationsDirectory,
+// });
+```
+
+The exported string resolves to the five SQL files inside the installed package.
+Keep this infrastructure entry out of browser and Worker imports. The root/server
+graphs contain no Node migration module. `vp run alchemy` packs/installs with pnpm
+and exercises the pinned Alchemy local D1/Worker lifecycle, including an update
+with unchanged migration identities and publication data. This proof uses local
+workerd, no remote resources or credentials. See the repository's issue #4 evidence.
+
+The HTTP methods are `handleEvent(request, { siteOrigin? }?)` and
+`handleRefresh(request, { siteOrigin? }?)`, both returning standard `Response`s.
+Sites wire their POST routes directly to these methods; other methods return
+405 with `Allow: POST`. Responses use `Cache-Control: no-store`.
+
+Events require `PUBLICATION_EVENT_SECRET` and refresh requires
+`FRONTEND_REFRESH_TOKEN`, each at least 32 characters, plus `PUBLICATION_DB`.
+An absent or short credential disables its handler without disabling stored
+public reads. Event HMAC verification and Site/schema checks precede any CMS
+reads or store changes. Refresh uses bearer authorization; `{}` refreshes the
+whole Site and `{"uris":["/about/"]}` targets 1–100 entry paths. Language homes
+require a whole-Site refresh. A signed withdrawal hides every stored route of
+that entry immediately, without reading the CMS. Refreshes cannot lift it;
+only a later publication can.
+
+Signed `reconcile` events compare canonical shared rows and the complete
+published-entry list, repair differences through normal publication rules, and
+rotate rereads of unchanged entries. Runs hold a D1 lease, reserve a bounded CMS
+request budget, and persist outcomes and pending counts for continuation.
+Responses retain the source protocol: 200 for `reconciled`, `behind` or `busy`;
+503 for `failed`, preserving last-known-good content. Incomplete lists remove
+nothing. Every configured language has separate home/chrome rows; design is
+shared.
+
+Signed `check` events return `{ status: "checked", site, reconciliation, store }`.
+`store` reports shared row states, entry-state counts, active withdrawals and
+failed events, plus other language row states under `languages`. It is null
+when unavailable. `reconciliation` reports the last run, counts, failure and
+last matched time, or null before any run. These are runtime evidence for the
+Blueprint readiness gate; readiness orchestration, media checks and provisioning
+remain Blueprint-owned. No storage or reconciliation helpers are public exports.
+
+`vp run pair` exercises installed WordPress/package transport; `vp run alchemy`
+retains the local installed-package/workerd migration and protocol proof.
+`vp run reconciliation` additionally installs the pair and runs actual
+WordPress/Polylang CLI and scheduler HTTP into the installed workerd consumer,
+using GraphQL answers projected from real CMS state. It verifies convergence,
+partial runs, outages/recovery and complete pending/failed records across Worker
+updates. Full P6 release evidence remains issue #11.
+
+## Consent and legal links
+
+CONSENT-1/LEGAL-1 ship as isolated entries: `@getquick/content/consent`
+(neutral core), `/consent/client` (browser runtime), `/consent/server` (the
+`/gq/consent` record and read endpoints and purge), `/consent/migrations`
+(the separate consent database), `/consent/astro` (default UI and legal
+footer as HTML) and `/consent/testing` (acceptance suite). They import no
+content runtime, framework or WordPress client. Passing
+`consent: { services: ["youtube"], cmsSettings: true }` to
+`createContentRuntime` rewrites third-party embeds into consent placeholders
+at delivery and stores gq-config's Legal Contract and GA4 settings in each
+language's chrome; `runtime.consentConfiguration(chrome)` returns the page's
+consent configuration. See the repository's `docs/consent.md`.

package/consent-migrations/0001_consent_records.sql

@@ -0,0 +1,34 @@
+-- The consent database (CONSENT-1 CN-R7/R8): a dedicated D1 database per Site
+-- and stage, created with jurisdiction "eu", separate from the publication
+-- database. One row per decision; rows are never updated. Rows are deleted
+-- only by the retention purge (CN-R10). No IP address, user agent or account
+-- link is stored.
+CREATE TABLE consent_records (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  consent_id TEXT NOT NULL,
+  site_id TEXT NOT NULL,
+  -- Server UTC time, ISO 8601 with milliseconds.
+  recorded_at TEXT NOT NULL,
+  -- The browser's decision time: with consent_id, a retried post's identity.
+  decided_at TEXT NOT NULL,
+  -- When the decision expires if nothing supersedes it (6 months).
+  expires_at TEXT NOT NULL,
+  config_version TEXT NOT NULL,
+  legal_revisions TEXT NOT NULL,
+  preferences INTEGER NOT NULL CHECK (preferences IN (0, 1)),
+  analytics INTEGER NOT NULL CHECK (analytics IN (0, 1)),
+  marketing INTEGER NOT NULL CHECK (marketing IN (0, 1)),
+  external_media INTEGER NOT NULL CHECK (external_media IN (0, 1)),
+  action TEXT NOT NULL CHECK (action IN ('accept_all', 'reject_all', 'custom', 'withdraw', 'renew')),
+  language TEXT NOT NULL,
+  ui_version TEXT NOT NULL,
+  UNIQUE (consent_id, decided_at)
+);
+
+CREATE INDEX consent_records_by_time ON consent_records (recorded_at);
+
+CREATE TRIGGER consent_records_append_only
+BEFORE UPDATE ON consent_records
+BEGIN
+  SELECT RAISE(ABORT, 'consent records are append-only');
+END;

package/dist/bearer-DMOCoSci.js

@@ -0,0 +1,16 @@
+//#region frontend/src/bearer.ts
+/**
+* Whether a request carries `Authorization: Bearer <token>`. Both sides are
+* hashed first, so the comparison's time depends on neither value nor length.
+* Shared by the refresh and consent read endpoints; dependency-free.
+*/
+async function bearerMatches(request, token) {
+	const presented = /^Bearer (.+)$/.exec(request.headers.get("Authorization") ?? "")?.[1] ?? "";
+	const digest = async (value) => new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value)));
+	const [expected, actual] = await Promise.all([digest(token), digest(presented)]);
+	let difference = presented ? 0 : 1;
+	for (let index = 0; index < expected.length; index += 1) difference |= expected[index] ^ actual[index];
+	return difference === 0;
+}
+//#endregion
+export { bearerMatches as t };

package/dist/client-config-B3LNSOxl.js

@@ -0,0 +1,4 @@
+//#region frontend/src/consent/client-config.ts
+const CONSENT_CONFIG_ID = "gq-consent-config";
+//#endregion
+export { CONSENT_CONFIG_ID as t };

package/dist/configuration-C_JGygQI.d.ts

@@ -0,0 +1,259 @@
+//#region frontend/src/consent/catalog.d.ts
+/**
+ * CONSENT-1's fixed purpose categories (CN-R2) and the Runtime's closed service
+ * catalog (CN-R3). Sites choose services from here; they cannot add categories
+ * or services. Adding a service is a Runtime release.
+ */
+declare const CONSENT_CATEGORIES: readonly ["necessary", "preferences", "analytics", "marketing", "external_media"];
+type ConsentCategory = (typeof CONSENT_CATEGORIES)[number];
+/** The categories a visitor decides on: every one but `necessary`, which is never a choice. */
+declare const OPTIONAL_CATEGORIES: readonly ["preferences", "analytics", "marketing", "external_media"];
+type OptionalCategory = (typeof OPTIONAL_CATEGORIES)[number];
+/** The languages Runtime-owned copy ships in (CN-C3). */
+declare const COPY_LANGUAGES: readonly ["en", "pt-PT"];
+type CopyLanguage = (typeof COPY_LANGUAGES)[number];
+type Copy = Record<CopyLanguage, string>;
+/** The copy language for a page's `lang` (BCP 47): Portuguese pages get pt-PT, others en. */
+declare function copyLanguage(lang: string | undefined): CopyLanguage;
+interface ConsentStorage {
+  name: string;
+  kind: "cookie" | "localStorage" | "sessionStorage";
+  /** `prefix`: every item whose name starts with `name`. */
+  match?: "exact" | "prefix";
+  /** First-party storage the Runtime can remove on withdrawal; third-party it cannot. */
+  party: "first" | "third";
+  duration: Copy;
+}
+interface ConsentService {
+  id: string;
+  category: ConsentCategory;
+  /** The provider's legal name. */
+  provider: string;
+  name: string;
+  purpose: Copy;
+  storage: ConsentStorage[];
+  /** How long the provider keeps the data it collects. */
+  retention: Copy;
+  privacyPolicy: string;
+  /** Domains the service contacts; a host matches a domain or any subdomain of it. */
+  hosts: string[];
+  /** The embed URLs that identify this service in HTML (host, optional path prefix). */
+  embeds?: Array<{
+    host: string;
+    path?: string;
+  }>;
+}
+declare const SERVICE_CATALOG: {
+  readonly consent: {
+    readonly id: "consent";
+    readonly category: "necessary";
+    readonly provider: "This website";
+    readonly name: "Consent choices";
+    readonly purpose: {
+      readonly en: "Remembers your consent choices and the consent ID that identifies them.";
+      readonly "pt-PT": "Memoriza as suas escolhas de consentimento e o ID que as identifica.";
+    };
+    readonly storage: [{
+      readonly name: "gq_consent";
+      readonly kind: "cookie";
+      readonly party: "first";
+      readonly duration: Copy;
+    }];
+    readonly retention: {
+      readonly en: "Records: 5 years after the choice stops being in force.";
+      readonly "pt-PT": "Registos: 5 anos após a escolha deixar de estar em vigor.";
+    };
+    readonly privacyPolicy: "";
+    readonly hosts: [];
+  };
+  readonly turnstile: {
+    readonly id: "turnstile";
+    readonly category: "necessary";
+    readonly provider: "Cloudflare, Inc.";
+    readonly name: "Cloudflare Turnstile";
+    readonly purpose: {
+      readonly en: "Protects sign-in, registration and checkout against abuse, only on those actions.";
+      readonly "pt-PT": "Protege o início de sessão, o registo e a finalização de compra contra abusos, apenas nessas ações.";
+    };
+    readonly storage: [];
+    readonly retention: {
+      readonly en: "Not stored by this website.";
+      readonly "pt-PT": "Não guardado por este website.";
+    };
+    readonly privacyPolicy: "https://www.cloudflare.com/privacypolicy/";
+    readonly hosts: ["challenges.cloudflare.com"];
+  };
+  readonly ga4: {
+    readonly id: "ga4";
+    readonly category: "analytics";
+    readonly provider: "Google Ireland Limited";
+    readonly name: "Google Analytics 4";
+    readonly purpose: {
+      readonly en: "Measures how visitors use the website, in aggregate (Consent Mode v2, basic mode).";
+      readonly "pt-PT": "Mede, de forma agregada, como os visitantes usam o website (Consent Mode v2, modo básico).";
+    };
+    readonly storage: [{
+      readonly name: "_ga";
+      readonly kind: "cookie";
+      readonly match: "prefix";
+      readonly party: "first";
+      readonly duration: {
+        readonly en: "Up to 2 years";
+        readonly "pt-PT": "Até 2 anos";
+      };
+    }];
+    readonly retention: {
+      readonly en: "14 months at Google (default data retention).";
+      readonly "pt-PT": "14 meses na Google (retenção de dados predefinida).";
+    };
+    readonly privacyPolicy: "https://policies.google.com/privacy";
+    readonly hosts: ["googletagmanager.com", "google-analytics.com", "analytics.google.com"];
+  };
+  readonly youtube: {
+    readonly id: "youtube";
+    readonly category: "external_media";
+    readonly provider: "Google Ireland Limited";
+    readonly name: "YouTube";
+    readonly purpose: {
+      readonly en: "Plays embedded YouTube videos. Loading one sends your IP address to YouTube.";
+      readonly "pt-PT": "Reproduz vídeos do YouTube incorporados. Carregar um envia o seu endereço IP ao YouTube.";
+    };
+    readonly storage: [{
+      readonly name: "VISITOR_INFO1_LIVE, YSC";
+      readonly kind: "cookie";
+      readonly party: "third";
+      readonly duration: {
+        readonly en: "Session to 6 months";
+        readonly "pt-PT": "Sessão a 6 meses";
+      };
+    }];
+    readonly retention: {
+      readonly en: "Set by Google; see its privacy policy.";
+      readonly "pt-PT": "Definida pela Google; consulte a sua política de privacidade.";
+    };
+    readonly privacyPolicy: "https://policies.google.com/privacy";
+    readonly hosts: ["youtube.com", "youtube-nocookie.com", "ytimg.com", "googlevideo.com", "ggpht.com"];
+    readonly embeds: [{
+      readonly host: "youtube.com";
+    }, {
+      readonly host: "youtube-nocookie.com";
+    }];
+  };
+  readonly vimeo: {
+    readonly id: "vimeo";
+    readonly category: "external_media";
+    readonly provider: "Vimeo.com, Inc.";
+    readonly name: "Vimeo";
+    readonly purpose: {
+      readonly en: "Plays embedded Vimeo videos. Loading one sends your IP address to Vimeo.";
+      readonly "pt-PT": "Reproduz vídeos do Vimeo incorporados. Carregar um envia o seu endereço IP ao Vimeo.";
+    };
+    readonly storage: [{
+      readonly name: "vuid";
+      readonly kind: "cookie";
+      readonly party: "third";
+      readonly duration: {
+        readonly en: "2 years";
+        readonly "pt-PT": "2 anos";
+      };
+    }];
+    readonly retention: {
+      readonly en: "Set by Vimeo; see its privacy policy.";
+      readonly "pt-PT": "Definida pela Vimeo; consulte a sua política de privacidade.";
+    };
+    readonly privacyPolicy: "https://vimeo.com/privacy";
+    readonly hosts: ["vimeo.com", "vimeocdn.com"];
+    readonly embeds: [{
+      readonly host: "player.vimeo.com";
+    }];
+  };
+  readonly google_maps: {
+    readonly id: "google_maps";
+    readonly category: "external_media";
+    readonly provider: "Google Ireland Limited";
+    readonly name: "Google Maps";
+    readonly purpose: {
+      readonly en: "Shows an embedded map. Loading it sends your IP address to Google.";
+      readonly "pt-PT": "Mostra um mapa incorporado. Carregá-lo envia o seu endereço IP à Google.";
+    };
+    readonly storage: [{
+      readonly name: "NID";
+      readonly kind: "cookie";
+      readonly party: "third";
+      readonly duration: {
+        readonly en: "6 months";
+        readonly "pt-PT": "6 meses";
+      };
+    }];
+    readonly retention: {
+      readonly en: "Set by Google; see its privacy policy.";
+      readonly "pt-PT": "Definida pela Google; consulte a sua política de privacidade.";
+    };
+    readonly privacyPolicy: "https://policies.google.com/privacy";
+    readonly hosts: ["google.com", "googleapis.com", "gstatic.com"];
+    readonly embeds: [{
+      readonly host: "www.google.com";
+      readonly path: "/maps";
+    }, {
+      readonly host: "google.com";
+      readonly path: "/maps";
+    }, {
+      readonly host: "maps.google.com";
+    }];
+  };
+};
+type ServiceId = keyof typeof SERVICE_CATALOG;
+declare const SERVICE_IDS: ServiceId[];
+declare function isServiceId(value: unknown): value is ServiceId;
+declare function catalogService(id: ServiceId): ConsentService;
+/** Whether a host is a domain or one of its subdomains. */
+declare function hostMatches(host: string, domain: string): boolean;
+/** The catalog service an embed URL belongs to, if any. */
+declare function embedService(url: URL): ServiceId | null;
+/** The catalog service whose hosts include a host, if any. */
+declare function hostService(host: string): ServiceId | null;
+//#endregion
+//#region frontend/src/consent/configuration.d.ts
+/**
+ * The revision of the Runtime's banner copy that counts as material. Copy edits
+ * keep it (CN-R5); only a reviewed change of what the visitor is told about
+ * processing bumps it.
+ */
+declare const CONSENT_COPY_REVISION = 1;
+/** gq-config's GA4 settings: the toggle and the measurement ID (GraphQL `googleAnalytics`). */
+interface AnalyticsSettings {
+  enabled: boolean;
+  measurementId: string | null;
+}
+/** A GA4 measurement ID. Anything else leaves GA4 inactive. */
+declare const MEASUREMENT_ID: RegExp;
+interface ConsentConfigurationInput {
+  /** The catalog services the Site declares in code. */
+  services?: readonly string[];
+  /** gq-config's analytics settings: GA4 is active only when its toggle is on (ticket 08). */
+  analytics?: AnalyticsSettings | null;
+  /** The data controller's legal name (LEGAL-1); changing it is material. */
+  controller?: string | null;
+}
+interface ConsentConfiguration {
+  schemaVersion: 1;
+  /** Every active service, necessary ones included, sorted. */
+  services: ServiceId[];
+  /** The optional categories at least one active service is in, in category order. */
+  categories: OptionalCategory[];
+  /** GA4's measurement ID, when GA4 is active. */
+  measurementId: string | null;
+  /** A short hash of the controller's name, empty when unknown; a change between known ones is material. */
+  controller: string;
+  /** The consent configuration version: categories, services, controller and copy revision. */
+  version: string;
+}
+/**
+ * A Site's consent configuration: the union of services it declares in code and
+ * those its settings switch on. Unknown services are refused: the set is closed.
+ */
+declare function consentConfiguration(input?: ConsentConfigurationInput): ConsentConfiguration;
+/** CN-C1: a Site with no active service outside `necessary` shows no banner and records nothing. */
+declare function needsBanner(configuration: ConsentConfiguration): boolean;
+//#endregion
+export { hostMatches as C, embedService as S, isServiceId as T, SERVICE_CATALOG as _, MEASUREMENT_ID as a, catalogService as b, CONSENT_CATEGORIES as c, ConsentService as d, ConsentStorage as f, OptionalCategory as g, OPTIONAL_CATEGORIES as h, ConsentConfigurationInput as i, COPY_LANGUAGES as l, CopyLanguage as m, CONSENT_COPY_REVISION as n, consentConfiguration as o, Copy as p, ConsentConfiguration as r, needsBanner as s, AnalyticsSettings as t, ConsentCategory as u, SERVICE_IDS as v, hostService as w, copyLanguage as x, ServiceId as y };

package/dist/consent-astro.d.ts

@@ -0,0 +1,36 @@
+import { r as ConsentConfiguration } from "./configuration-C_JGygQI.js";
+import { r as LegalLanguage } from "./legal-C5Xiq59W.js";
+//#region frontend/src/consent/astro.d.ts
+export interface ConsentPageInput {
+  configuration: ConsentConfiguration;
+  /** The page's `lang` (BCP 47): the UI follows it (CN-C3). */
+  language: string;
+  /** The page language's Legal Contract, from the chrome (LEGAL-1); null when not delivered yet. */
+  legal?: LegalLanguage | null;
+  /** The request's Cookie header: the banner is rendered open only without a decision in force. */
+  cookie?: string | null;
+  now?: number;
+  /** Include the default stylesheet (Sites restyle through its custom properties). */
+  styles?: boolean;
+}
+export interface ConsentPage {
+  /** For `<head>`: the configuration the client reads, and the default styles. */
+  head: string;
+  /** For the start of `<body>`: the banner (first in focus order) and the preferences dialog. */
+  body: string;
+  /** For the footer: the legal links and the persistent "Cookie settings" control. */
+  footer: string;
+  /** Whether the banner is rendered open. */
+  bannerOpen: boolean;
+}
+/** The legal links and "Cookie settings" control for a footer (LG-R5, CN-R6). */
+export declare function legalFooter(legal: LegalLanguage | null | undefined, language: string): string;
+/** Everything the default UI renders on one page. */
+export declare function consentPage(input: ConsentPageInput): ConsentPage;
+/**
+ * The default stylesheet. Sites restyle it through these custom properties or
+ * their own CSS (CN-C4); the two first-layer choices share one class so they
+ * keep equal prominence.
+ */
+export declare const CONSENT_STYLES: string;
+//#endregion

package/dist/consent-astro.js

@@ -0,0 +1,94 @@
+import { S as SERVICE_CATALOG, T as copyLanguage, c as grantedCategories, d as promptReason, f as readConsentCookie, x as OPTIONAL_CATEGORIES } from "./state-BYWc5TUB.js";
+import { a as CONSENT_COPY, c as legalRevisions, r as escapeHtml } from "./embeds-p9SyGNZI.js";
+import { t as CONSENT_UI_VERSION } from "./version-Dn6VLZJO.js";
+import { t as CONSENT_CONFIG_ID } from "./client-config-B3LNSOxl.js";
+import { t as CONSENT_PATH } from "./paths-Cmzzof3v.js";
+//#region frontend/src/consent/astro.ts
+function storageText(service, language) {
+	const copy = CONSENT_COPY[language];
+	return service.storage.map((item) => `${item.name}${item.match === "prefix" ? "*" : ""} (${item.kind}, ${item.duration[language]}${item.party === "third" ? `; ${copy.thirdPartyStorage}` : ""})`).join("; ");
+}
+function serviceList(services, language) {
+	if (!services.length) return "";
+	const copy = CONSENT_COPY[language];
+	return `<ul class="gq-consent-services">${services.map((service) => {
+		const storage = storageText(service, language);
+		return `<li class="gq-consent-service"><strong>${escapeHtml(service.name)}</strong><dl><dt>${escapeHtml(copy.provider)}</dt><dd>${escapeHtml(service.provider)}</dd><dt>${escapeHtml(copy.purpose)}</dt><dd>${escapeHtml(service.purpose[language])}</dd><dt>${escapeHtml(copy.storage)}</dt><dd>${escapeHtml(storage || "—")}</dd><dt>${escapeHtml(copy.retention)}</dt><dd>${escapeHtml(service.retention[language])}</dd></dl></li>`;
+	}).join("")}</ul>`;
+}
+function link(href, text, attributes = "") {
+	return `<a href="${escapeHtml(href)}"${attributes}>${escapeHtml(text)}</a>`;
+}
+/** The legal links and "Cookie settings" control for a footer (LG-R5, CN-R6). */
+function legalFooter(legal, language) {
+	const lang = copyLanguage(language);
+	const copy = CONSENT_COPY[lang];
+	const items = (legal?.roles ?? []).map((role) => `<li>${link(role.url, role.title ?? copy.legal[role.role] ?? role.role, ` data-gq-legal-role="${escapeHtml(role.role)}"`)}</li>`);
+	items.push(`<li><button type="button" class="gq-consent-settings" data-gq-consent-open aria-haspopup="dialog" aria-controls="gq-consent-preferences">${escapeHtml(copy.cookieSettings)}</button></li>`);
+	return `<nav class="gq-legal" aria-label="${escapeHtml(copy.legalNavigation)}"><ul>${items.join("")}</ul></nav>`;
+}
+/** Everything the default UI renders on one page. */
+function consentPage(input) {
+	const { configuration } = input;
+	const lang = copyLanguage(input.language);
+	const copy = CONSENT_COPY[lang];
+	const state = readConsentCookie(input.cookie);
+	const now = input.now ?? Date.now();
+	const bannerOpen = promptReason(configuration, state, now) !== null;
+	const inForce = grantedCategories(configuration, state, now);
+	const cookiePolicy = input.legal?.roles.find((role) => role.role === "cookie_policy");
+	const config = {
+		configuration,
+		language: input.language,
+		uiVersion: CONSENT_UI_VERSION,
+		legalRevisions: legalRevisions(input.legal),
+		endpoint: CONSENT_PATH
+	};
+	const head = `<script type="application/json" id="${CONSENT_CONFIG_ID}">${JSON.stringify(config).replaceAll("<", "\\u003c")}<\/script>` + (input.styles === false ? "" : `<style data-gq-consent-styles>${CONSENT_STYLES}</style>`);
+	const services = configuration.services.map((id) => SERVICE_CATALOG[id]);
+	const inCategory = (category) => services.filter((service) => service.category === category);
+	const optional = configuration.categories.length > 0;
+	const banner = !optional ? "" : `<section id="gq-consent-banner" class="gq-consent-banner" role="dialog" aria-modal="false" aria-labelledby="gq-consent-banner-title" aria-describedby="gq-consent-banner-text" lang="${escapeHtml(input.language)}"${bannerOpen ? "" : " hidden"}><h2 id="gq-consent-banner-title" class="gq-consent-banner__title">${escapeHtml(copy.bannerTitle)}</h2><p id="gq-consent-banner-text" class="gq-consent-banner__text">${escapeHtml(copy.bannerText)}` + (cookiePolicy ? ` ${link(cookiePolicy.url, copy.cookiePolicy, " class=\"gq-consent-banner__policy\"")}` : "") + `</p><div class="gq-consent-banner__actions"><button type="button" class="gq-consent-button gq-consent-button--choice" data-gq-consent-reject-all>${escapeHtml(copy.rejectAll)}</button><button type="button" class="gq-consent-button gq-consent-button--choice" data-gq-consent-accept-all>${escapeHtml(copy.acceptAll)}</button><button type="button" class="gq-consent-button gq-consent-button--secondary" data-gq-consent-customise aria-haspopup="dialog" aria-controls="gq-consent-preferences">${escapeHtml(copy.customise)}</button></div></section>`;
+	const necessary = copy.categories.necessary;
+	const categories = OPTIONAL_CATEGORIES.filter((category) => configuration.categories.includes(category)).map((category) => {
+		const text = copy.categories[category];
+		const id = `gq-consent-category-${category}`;
+		return `<fieldset class="gq-consent-category"><legend>${escapeHtml(text.name)}</legend><label for="${id}"><input type="checkbox" id="${id}" name="${category}" value="${category}" data-gq-consent-category${inForce.includes(category) ? " checked" : ""}> ${escapeHtml(text.name)}</label><p>${escapeHtml(text.description)}</p>${serviceList(inCategory(category), lang)}</fieldset>`;
+	});
+	return {
+		head,
+		body: banner + (`<dialog id="gq-consent-preferences" class="gq-consent-preferences" aria-labelledby="gq-consent-preferences-title" lang="${escapeHtml(input.language)}"><form method="dialog"><h2 id="gq-consent-preferences-title">${escapeHtml(copy.preferencesTitle)}</h2><p>${escapeHtml(copy.preferencesText)}</p>` + (cookiePolicy ? `<p>${link(cookiePolicy.url, copy.cookiePolicy)}</p>` : "") + `<fieldset class="gq-consent-category"><legend>${escapeHtml(necessary.name)}</legend><p>${escapeHtml(copy.alwaysOn)}. ${escapeHtml(necessary.description)}</p>${serviceList(inCategory("necessary"), lang)}</fieldset>` + categories.join("") + (optional ? `<p class="gq-consent-id">${escapeHtml(copy.consentId)}: <code data-gq-consent-id data-gq-consent-none="${escapeHtml(copy.noDecision)}">${escapeHtml(state?.consentId ?? copy.noDecision)}</code></p>` : "") + `<div class="gq-consent-preferences__actions">` + (optional ? `<button type="button" class="gq-consent-button gq-consent-button--choice" data-gq-consent-reject-all>${escapeHtml(copy.rejectAll)}</button><button type="button" class="gq-consent-button gq-consent-button--choice" data-gq-consent-accept-all>${escapeHtml(copy.acceptAll)}</button><button type="button" class="gq-consent-button gq-consent-button--secondary" data-gq-consent-save>${escapeHtml(copy.save)}</button>` : "") + `<button type="button" class="gq-consent-button gq-consent-button--secondary" data-gq-consent-close>${escapeHtml(copy.close)}</button></div></form></dialog>`),
+		footer: legalFooter(input.legal, input.language),
+		bannerOpen
+	};
+}
+/**
+* The default stylesheet. Sites restyle it through these custom properties or
+* their own CSS (CN-C4); the two first-layer choices share one class so they
+* keep equal prominence.
+*/
+const CONSENT_STYLES = `
+.gq-consent-banner{position:fixed;inset:auto 1rem 1rem 1rem;z-index:2147483000;max-width:44rem;margin:0 auto;padding:1.25rem;background:var(--gq-consent-background,#fff);color:var(--gq-consent-color,#111);border:1px solid var(--gq-consent-border,#888);border-radius:var(--gq-consent-radius,.5rem);box-shadow:0 .5rem 2rem rgba(0,0,0,.2);font:inherit}
+.gq-consent-banner[hidden]{display:none}
+.gq-consent-banner__title,.gq-consent-preferences h2{margin:0 0 .5rem;font-size:1.125rem}
+.gq-consent-banner__actions,.gq-consent-preferences__actions,.gq-consent-embed__actions{display:flex;flex-wrap:wrap;gap:.5rem;margin-top:1rem}
+.gq-consent-button{font:inherit;cursor:pointer;padding:.6rem 1rem;border-radius:var(--gq-consent-radius,.5rem);border:2px solid var(--gq-consent-accent,#111)}
+.gq-consent-button--choice{flex:1 1 10rem;background:var(--gq-consent-accent,#111);color:var(--gq-consent-accent-contrast,#fff)}
+.gq-consent-button--secondary{background:transparent;color:inherit}
+.gq-consent-button:focus-visible,.gq-consent-settings:focus-visible{outline:3px solid var(--gq-consent-focus,#1a73e8);outline-offset:2px}
+.gq-consent-preferences{max-width:40rem;width:calc(100% - 2rem);max-height:calc(100vh - 2rem);overflow:auto;padding:1.25rem;border:1px solid var(--gq-consent-border,#888);border-radius:var(--gq-consent-radius,.5rem);background:var(--gq-consent-background,#fff);color:var(--gq-consent-color,#111)}
+.gq-consent-category{border:1px solid var(--gq-consent-border,#ccc);border-radius:.375rem;margin:.75rem 0;padding:.75rem}
+.gq-consent-services{margin:.5rem 0 0;padding-left:1rem;font-size:.875rem}
+.gq-consent-services dl{display:grid;grid-template-columns:max-content 1fr;gap:.125rem .5rem;margin:.25rem 0}
+.gq-consent-services dd{margin:0}
+.gq-consent-embed{position:relative;display:flex;align-items:center;justify-content:center;width:100%;min-height:12rem;background:var(--gq-consent-embed-background,#eee);color:var(--gq-consent-color,#111)}
+.gq-consent-embed[data-gq-loaded]{display:block;min-height:0;background:none}
+.gq-consent-embed[data-gq-loaded]>iframe{width:100%;height:100%;border:0}
+.gq-consent-embed--decorative{position:absolute;inset:0;min-height:0;background:none}
+.gq-consent-embed__notice{max-width:32rem;padding:1rem;text-align:center}
+.gq-consent-blocked{padding:1rem;background:var(--gq-consent-embed-background,#eee)}
+.gq-legal ul{display:flex;flex-wrap:wrap;gap:.5rem 1rem;list-style:none;margin:0;padding:0}
+.gq-consent-settings{font:inherit;color:inherit;background:none;border:0;padding:0;text-decoration:underline;cursor:pointer}
+`.trim();
+//#endregion
+export { CONSENT_STYLES, consentPage, legalFooter };

package/dist/consent-client.d.ts

@@ -0,0 +1,37 @@
+import { r as ConsentConfiguration } from "./configuration-C_JGygQI.js";
+import { a as ConsentChoice, i as ConsentAction, s as ConsentState } from "./state-Dzd52F3c.js";
+//#region frontend/src/consent/client-config.d.ts
+/** The JSON the server renders into `<script type="application/json" id="gq-consent-config">`. */
+interface ConsentPageConfig {
+  configuration: ConsentConfiguration;
+  /** The page's `lang`, recorded as the banner language. */
+  language: string;
+  uiVersion: string;
+  legalRevisions: Record<string, string>;
+  endpoint: string;
+}
+export declare const CONSENT_CONFIG_ID = "gq-consent-config";
+//#endregion
+//#region frontend/src/consent/client.d.ts
+export interface ConsentController {
+  readonly state: ConsentState | null;
+  readonly config: ConsentPageConfig;
+  choose(choice: ConsentChoice): void;
+  openPreferences(opener?: HTMLElement | null): void;
+  /** Re-applies grants to the current document (after a client-side navigation). */
+  refresh(): void;
+}
+declare global {
+  interface Window {
+    dataLayer?: unknown[];
+    gtag?: (...args: unknown[]) => void;
+    __gqConsent?: ConsentController;
+  }
+}
+/**
+ * Starts the runtime once per document. Safe to call again: the existing
+ * controller refreshes the page instead.
+ */
+export declare function startConsent(): ConsentController | null;
+//#endregion
+export type { ConsentAction, ConsentChoice, ConsentPageConfig, ConsentState };