@getquick/content 0.4.1 → 0.5.0

package/README.md

@@ -288,14 +288,16 @@ updates. Full P6 release evidence remains issue #11.
 CONSENT-1/LEGAL-1 ship as isolated entries: `@getquick/content/consent`
 (neutral core), `/consent/client` (browser runtime), `/consent/server` (the
 `/gq/consent` record and read endpoints and purge), `/consent/migrations`
-(the separate consent database), `/consent/astro` (default UI and legal
-footer as HTML) and `/consent/testing` (acceptance suite). They import no
+(the separate consent database), `/consent/html` (default UI and legal
+footer as HTML), `/consent/astro` (compatible re-export) and `/consent/testing` (acceptance suite). They import no
 content runtime, framework or WordPress client. Passing
 `consent: { services: ["youtube"], cmsSettings: true }` to
 `createContentRuntime` rewrites third-party embeds into consent placeholders
 at delivery and stores gq-config's Legal Contract and GA4 settings in each
 language's chrome; `runtime.consentConfiguration(chrome)` returns the page's
-consent configuration. See the repository's `docs/consent.md`.
+consent configuration. See the repository's `docs/consent.md` export index and the
+platform-owned [consent HTML reference](https://github.com/Quick-Release/gq-platform/blob/main/docs/runtime/gq-content/consent-html.md)
+([platform PR #273](https://github.com/Quick-Release/gq-platform/pull/273)).
 
 ## Design presentation and composition
 
@@ -307,6 +309,40 @@ per response, using the delivered `theme` from entry/home/chrome. Resolve defaul
 with `resolveDesignTheme` for older stored publications. A changed theme requires
 regenerating both stylesheets, including its media thresholds.
 
+### Fonts and text styles
+
+GQ Design 0.10.1 (contract 2.1.0) delivers the Site's self-hosted font families
+(faces on the Site's own or media host, each with a metric-matched local
+fallback), the `sans`/`serif`/`mono` slot assignments and the Heading and
+Paragraph text styles. The design presets carry them as optional `fonts` and
+`textStyles`: read with the other presets, stored with them, refreshed by the
+`design` settings event (a global styles save, a font slot assignment, or a
+Font Library family or face saved or deleted) and compared by reconciliation.
+A CMS whose GQ Design predates them rejects the fields; the presets are read
+again without them, with a warning, and pages keep the theme's system stacks.
+
+Emit them once per response, in the head, after `designThemeStyleSheet(theme)`:
+
+```astro
+<style is:inline set:html={designThemeStyleSheet(theme)} />
+<Fragment set:html={designFontsHead(await runtime.designPresets())} />
+```
+
+`designFontsHead(presets, { root? })` returns, in order: at most two
+`<link rel="preload" as="font" type="font/woff2" href="…" crossorigin>` for the
+faces GQ Design marks (the text styles' primary Latin files); a
+`<style data-gqd-fonts>` with the `@font-face` rules (`font-display` as
+delivered, `swap` from GQ Design), the fallback faces and the assigned slots'
+`--gqd-font-*` stacks; and a `<style data-gqd-text-styles>` with the text
+styles under `root` (default `.gqd-content`, the theme's root). The slot stacks
+are set on `:root` and again on the root, because the theme stylesheet declares
+the system stacks there. It is empty without fonts or text styles, or with no
+families. Font URLs only come from the presets: faces with a relative URL or a
+file on a Google host are dropped, so a visitor's browser never contacts
+Google. Media hosts need a public CORS rule for cross-origin font files.
+`designFontStyleSheet`, `designFontPreloads` (link descriptors for another
+serializer) and `designTextStyleSheet` return the parts.
+
 `presentationHtml(name, shell, presentation, { attributes, model? })` decorates an
 existing root shell. Pass the complete block attributes for native Group layout
 context. `presentationVariables` takes the same attributes context. Both delegate

package/dist/client-ip-cnqPLdDa.js

@@ -0,0 +1,203 @@
+//#region frontend/src/request-guards.ts
+/**
+* Whether a browser posted from the Site itself. A cross-site post carries
+* its Origin (and Sec-Fetch-Site); `origins` are the Site's public origins
+* when the Worker sees another (a proxy). The request's own origin is always
+* accepted.
+*/
+function isSameOrigin(request, origins) {
+	const origin = request.headers.get("Origin");
+	const site = request.headers.get("Sec-Fetch-Site");
+	if (site && site !== "same-origin") return false;
+	if (!origin) return false;
+	if (origin === new URL(request.url).origin || origins.has(origin)) return true;
+	try {
+		return new URL(origin).host === request.headers.get("Host");
+	} catch {
+		return false;
+	}
+}
+/** The body as text, or null once it exceeds `limit` bytes (declared or read). */
+async function readBoundedBody(request, limit) {
+	if (Number(request.headers.get("Content-Length") ?? "0") > limit) return null;
+	if (!request.body) return "";
+	const reader = request.body.getReader();
+	const chunks = [];
+	let size = 0;
+	for (;;) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		size += value.byteLength;
+		if (size > limit) {
+			await reader.cancel();
+			return null;
+		}
+		chunks.push(value);
+	}
+	const bytes = new Uint8Array(size);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return new TextDecoder().decode(bytes);
+}
+//#endregion
+//#region frontend/src/client-ip.ts
+function parseIpv4(text) {
+	const parts = text.split(".");
+	if (parts.length !== 4) return null;
+	const bytes = /* @__PURE__ */ new Uint8Array(4);
+	for (const [index, part] of parts.entries()) {
+		if (!/^(0|[1-9]\d{0,2})$/.test(part) || Number(part) > 255) return null;
+		bytes[index] = Number(part);
+	}
+	return bytes;
+}
+function parseIpv6(text) {
+	let head = text;
+	let tail = [];
+	const lastColon = text.lastIndexOf(":");
+	if (text.includes(".", lastColon)) {
+		const v4 = parseIpv4(text.slice(lastColon + 1));
+		if (!v4) return null;
+		head = text.slice(0, lastColon + 1);
+		if (head.endsWith(":") && !head.endsWith("::")) head = head.slice(0, -1);
+		tail = [v4[0] << 8 | v4[1], v4[2] << 8 | v4[3]];
+	}
+	const halves = head.split("::");
+	if (halves.length > 2) return null;
+	const groups = (part) => part === "" ? [] : part.split(":");
+	const left = groups(halves[0]);
+	const right = halves.length === 2 ? groups(halves[1]) : [];
+	const words = [];
+	for (const group of [...left, ...right]) {
+		if (!/^[0-9a-f]{1,4}$/i.test(group)) return null;
+		words.push(parseInt(group, 16));
+	}
+	const given = words.length + tail.length;
+	if (halves.length === 2 ? given > 7 : given !== 8) return null;
+	const all = [
+		...words.slice(0, left.length),
+		...Array(8 - given).fill(0),
+		...words.slice(left.length),
+		...tail
+	];
+	const bytes = /* @__PURE__ */ new Uint8Array(16);
+	all.forEach((word, index) => {
+		bytes[index * 2] = word >> 8;
+		bytes[index * 2 + 1] = word & 255;
+	});
+	return bytes;
+}
+/** An IPv4 or IPv6 address; an IPv4-mapped IPv6 address reads as its IPv4. */
+function parseAddress(value) {
+	const text = value.trim();
+	if (!text || text.length > 64) return null;
+	if (!text.includes(":")) {
+		const bytes = parseIpv4(text);
+		return bytes ? {
+			version: 4,
+			bytes
+		} : null;
+	}
+	const bytes = parseIpv6(text.replace(/%[0-9a-z._~-]+$/i, ""));
+	if (!bytes) return null;
+	return bytes.slice(0, 10).every((byte) => byte === 0) && bytes[10] === 255 && bytes[11] === 255 ? {
+		version: 4,
+		bytes: bytes.slice(12)
+	} : {
+		version: 6,
+		bytes
+	};
+}
+/** An X-Forwarded-For entry: an address, optionally `[v6]:port` or `v4:port`. */
+function parseForwarded(value) {
+	const text = value.trim();
+	const bracketed = /^\[([^\]]+)\](?::\d{1,5})?$/.exec(text);
+	if (bracketed) return parseAddress(bracketed[1]);
+	const withPort = /^(\d{1,3}(?:\.\d{1,3}){3}):\d{1,5}$/.exec(text);
+	return parseAddress(withPort ? withPort[1] : text);
+}
+function format(address) {
+	if (address.version === 4) return address.bytes.join(".");
+	const words = Array.from({ length: 8 }, (_, index) => (address.bytes[index * 2] << 8 | address.bytes[index * 2 + 1]).toString(16));
+	let start = -1;
+	let length = 0;
+	for (let index = 0; index < 8;) {
+		if (words[index] !== "0") {
+			index += 1;
+			continue;
+		}
+		let end = index;
+		while (end < 8 && words[end] === "0") end += 1;
+		if (end - index > length && end - index > 1) [start, length] = [index, end - index];
+		index = end;
+	}
+	if (start < 0) return words.join(":");
+	return `${words.slice(0, start).join(":")}::${words.slice(start + length).join(":")}`;
+}
+function parseRange(value) {
+	const [text, prefixText, extra] = value.trim().split("/");
+	const address = extra === void 0 ? parseAddress(text ?? "") : null;
+	if (!address) throw new Error(`trustedProxies: "${value}" isn't an IP address or CIDR`);
+	const bits = address.bytes.length * 8;
+	const prefix = prefixText === void 0 ? bits : Number(prefixText);
+	if (prefixText !== void 0 && !/^\d{1,3}$/.test(prefixText) || prefix > bits) throw new Error(`trustedProxies: "${value}" has an invalid prefix length`);
+	if (prefix === 0) throw new Error(`trustedProxies: "${value}" would trust every address`);
+	return {
+		...address,
+		prefix
+	};
+}
+function contains(range, address) {
+	if (range.version !== address.version) return false;
+	const whole = range.prefix >> 3;
+	for (let index = 0; index < whole; index += 1) if (range.bytes[index] !== address.bytes[index]) return false;
+	const rest = range.prefix & 7;
+	if (!rest) return true;
+	const mask = 255 << 8 - rest & 255;
+	return (range.bytes[whole] & mask) === (address.bytes[whole] & mask);
+}
+/**
+* The client address of a request, from `CF-Connecting-IP` and, only when
+* that is one of `trustedProxies` (addresses or CIDRs, IPv4 or IPv6), the
+* proxy's forwarding headers: the right-most `X-Forwarded-For` entry that
+* isn't itself a trusted proxy, else `X-Real-IP`. Null when there is no
+* usable `CF-Connecting-IP`. Throws on an invalid `trustedProxies` entry.
+*/
+function clientAddressResolver(trustedProxies = []) {
+	const ranges = trustedProxies.map(parseRange);
+	const trusted = (address) => ranges.some((range) => contains(range, address));
+	return (request) => {
+		const peer = parseAddress(request.headers.get("CF-Connecting-IP") ?? "");
+		if (!peer) return null;
+		if (!trusted(peer)) return format(peer);
+		const forwarded = (request.headers.get("X-Forwarded-For") ?? "").split(",").map((entry) => entry.trim()).filter(Boolean);
+		for (let index = forwarded.length - 1; index >= 0; index -= 1) {
+			const address = parseForwarded(forwarded[index]);
+			if (!address) return format(peer);
+			if (!trusted(address)) return format(address);
+		}
+		const real = parseAddress(request.headers.get("X-Real-IP") ?? "");
+		return real && !trusted(real) ? format(real) : format(peer);
+	};
+}
+/**
+* A rate-limit key for a client address: an IPv4 address as itself, an IPv6
+* address as its /64 (`2001:db8:1:2::/64`), since one subscriber holds a
+* whole /64. `unknown` without an address.
+*/
+function rateLimitKey(address) {
+	const parsed = address === null ? null : parseAddress(address);
+	if (!parsed) return "unknown";
+	if (parsed.version === 4) return format(parsed);
+	const network = /* @__PURE__ */ new Uint8Array(16);
+	network.set(parsed.bytes.slice(0, 8));
+	return `${format({
+		version: 6,
+		bytes: network
+	})}/64`;
+}
+//#endregion
+export { readBoundedBody as i, rateLimitKey as n, isSameOrigin as r, clientAddressResolver as t };

package/dist/consent-astro.d.ts

@@ -1,36 +1,2 @@
-import { r as ConsentConfiguration } from "./configuration-C_JGygQI.js";
-import { r as LegalLanguage } from "./legal-C5Xiq59W.js";
-//#region frontend/src/consent/astro.d.ts
-export interface ConsentPageInput {
-  configuration: ConsentConfiguration;
-  /** The page's `lang` (BCP 47): the UI follows it (CN-C3). */
-  language: string;
-  /** The page language's Legal Contract, from the chrome (LEGAL-1); null when not delivered yet. */
-  legal?: LegalLanguage | null;
-  /** The request's Cookie header: the banner is rendered open only without a decision in force. */
-  cookie?: string | null;
-  now?: number;
-  /** Include the default stylesheet (Sites restyle through its custom properties). */
-  styles?: boolean;
-}
-export interface ConsentPage {
-  /** For `<head>`: the configuration the client reads, and the default styles. */
-  head: string;
-  /** For the start of `<body>`: the banner (first in focus order) and the preferences dialog. */
-  body: string;
-  /** For the footer: the legal links and the persistent "Cookie settings" control. */
-  footer: string;
-  /** Whether the banner is rendered open. */
-  bannerOpen: boolean;
-}
-/** The legal links and "Cookie settings" control for a footer (LG-R5, CN-R6). */
-export declare function legalFooter(legal: LegalLanguage | null | undefined, language: string): string;
-/** Everything the default UI renders on one page. */
-export declare function consentPage(input: ConsentPageInput): ConsentPage;
-/**
- * The default stylesheet. Sites restyle it through these custom properties or
- * their own CSS (CN-C4); the two first-layer choices share one class so they
- * keep equal prominence.
- */
-export declare const CONSENT_STYLES: string;
-//#endregion
+import { CONSENT_STYLES, ConsentPage, ConsentPageInput, consentPage, legalFooter } from "./consent-html.js";
+export { CONSENT_STYLES, type ConsentPage, type ConsentPageInput, consentPage, legalFooter };

package/dist/consent-astro.js

@@ -1,94 +1,2 @@
-import { S as SERVICE_CATALOG, T as copyLanguage, c as grantedCategories, d as promptReason, f as readConsentCookie, x as OPTIONAL_CATEGORIES } from "./state-BYWc5TUB.js";
-import { a as CONSENT_COPY, c as legalRevisions, r as escapeHtml } from "./embeds-CJJemAmE.js";
-import { t as CONSENT_UI_VERSION } from "./version-Co2JJcK_.js";
-import { t as CONSENT_CONFIG_ID } from "./client-config-B3LNSOxl.js";
-import { t as CONSENT_PATH } from "./paths-Cmzzof3v.js";
-//#region frontend/src/consent/astro.ts
-function storageText(service, language) {
-	const copy = CONSENT_COPY[language];
-	return service.storage.map((item) => `${item.name}${item.match === "prefix" ? "*" : ""} (${item.kind}, ${item.duration[language]}${item.party === "third" ? `; ${copy.thirdPartyStorage}` : ""})`).join("; ");
-}
-function serviceList(services, language) {
-	if (!services.length) return "";
-	const copy = CONSENT_COPY[language];
-	return `<ul class="gq-consent-services">${services.map((service) => {
-		const storage = storageText(service, language);
-		return `<li class="gq-consent-service"><strong>${escapeHtml(service.name)}</strong><dl><dt>${escapeHtml(copy.provider)}</dt><dd>${escapeHtml(service.provider)}</dd><dt>${escapeHtml(copy.purpose)}</dt><dd>${escapeHtml(service.purpose[language])}</dd><dt>${escapeHtml(copy.storage)}</dt><dd>${escapeHtml(storage || "—")}</dd><dt>${escapeHtml(copy.retention)}</dt><dd>${escapeHtml(service.retention[language])}</dd></dl></li>`;
-	}).join("")}</ul>`;
-}
-function link(href, text, attributes = "") {
-	return `<a href="${escapeHtml(href)}"${attributes}>${escapeHtml(text)}</a>`;
-}
-/** The legal links and "Cookie settings" control for a footer (LG-R5, CN-R6). */
-function legalFooter(legal, language) {
-	const lang = copyLanguage(language);
-	const copy = CONSENT_COPY[lang];
-	const items = (legal?.roles ?? []).map((role) => `<li>${link(role.url, role.title ?? copy.legal[role.role] ?? role.role, ` data-gq-legal-role="${escapeHtml(role.role)}"`)}</li>`);
-	items.push(`<li><button type="button" class="gq-consent-settings" data-gq-consent-open aria-haspopup="dialog" aria-controls="gq-consent-preferences">${escapeHtml(copy.cookieSettings)}</button></li>`);
-	return `<nav class="gq-legal" aria-label="${escapeHtml(copy.legalNavigation)}"><ul>${items.join("")}</ul></nav>`;
-}
-/** Everything the default UI renders on one page. */
-function consentPage(input) {
-	const { configuration } = input;
-	const lang = copyLanguage(input.language);
-	const copy = CONSENT_COPY[lang];
-	const state = readConsentCookie(input.cookie);
-	const now = input.now ?? Date.now();
-	const bannerOpen = promptReason(configuration, state, now) !== null;
-	const inForce = grantedCategories(configuration, state, now);
-	const cookiePolicy = input.legal?.roles.find((role) => role.role === "cookie_policy");
-	const config = {
-		configuration,
-		language: input.language,
-		uiVersion: CONSENT_UI_VERSION,
-		legalRevisions: legalRevisions(input.legal),
-		endpoint: CONSENT_PATH
-	};
-	const head = `<script type="application/json" id="${CONSENT_CONFIG_ID}">${JSON.stringify(config).replaceAll("<", "\\u003c")}<\/script>` + (input.styles === false ? "" : `<style data-gq-consent-styles>${CONSENT_STYLES}</style>`);
-	const services = configuration.services.map((id) => SERVICE_CATALOG[id]);
-	const inCategory = (category) => services.filter((service) => service.category === category);
-	const optional = configuration.categories.length > 0;
-	const banner = !optional ? "" : `<section id="gq-consent-banner" class="gq-consent-banner" role="dialog" aria-modal="false" aria-labelledby="gq-consent-banner-title" aria-describedby="gq-consent-banner-text" lang="${escapeHtml(input.language)}"${bannerOpen ? "" : " hidden"}><h2 id="gq-consent-banner-title" class="gq-consent-banner__title">${escapeHtml(copy.bannerTitle)}</h2><p id="gq-consent-banner-text" class="gq-consent-banner__text">${escapeHtml(copy.bannerText)}` + (cookiePolicy ? ` ${link(cookiePolicy.url, copy.cookiePolicy, " class=\"gq-consent-banner__policy\"")}` : "") + `</p><div class="gq-consent-banner__actions"><button type="button" class="gq-consent-button gq-consent-button--choice" data-gq-consent-reject-all>${escapeHtml(copy.rejectAll)}</button><button type="button" class="gq-consent-button gq-consent-button--choice" data-gq-consent-accept-all>${escapeHtml(copy.acceptAll)}</button><button type="button" class="gq-consent-button gq-consent-button--secondary" data-gq-consent-customise aria-haspopup="dialog" aria-controls="gq-consent-preferences">${escapeHtml(copy.customise)}</button></div></section>`;
-	const necessary = copy.categories.necessary;
-	const categories = OPTIONAL_CATEGORIES.filter((category) => configuration.categories.includes(category)).map((category) => {
-		const text = copy.categories[category];
-		const id = `gq-consent-category-${category}`;
-		return `<fieldset class="gq-consent-category"><legend>${escapeHtml(text.name)}</legend><label for="${id}"><input type="checkbox" id="${id}" name="${category}" value="${category}" data-gq-consent-category${inForce.includes(category) ? " checked" : ""}> ${escapeHtml(text.name)}</label><p>${escapeHtml(text.description)}</p>${serviceList(inCategory(category), lang)}</fieldset>`;
-	});
-	return {
-		head,
-		body: banner + (`<dialog id="gq-consent-preferences" class="gq-consent-preferences" aria-labelledby="gq-consent-preferences-title" lang="${escapeHtml(input.language)}"><form method="dialog"><h2 id="gq-consent-preferences-title">${escapeHtml(copy.preferencesTitle)}</h2><p>${escapeHtml(copy.preferencesText)}</p>` + (cookiePolicy ? `<p>${link(cookiePolicy.url, copy.cookiePolicy)}</p>` : "") + `<fieldset class="gq-consent-category"><legend>${escapeHtml(necessary.name)}</legend><p>${escapeHtml(copy.alwaysOn)}. ${escapeHtml(necessary.description)}</p>${serviceList(inCategory("necessary"), lang)}</fieldset>` + categories.join("") + (optional ? `<p class="gq-consent-id">${escapeHtml(copy.consentId)}: <code data-gq-consent-id data-gq-consent-none="${escapeHtml(copy.noDecision)}">${escapeHtml(state?.consentId ?? copy.noDecision)}</code></p>` : "") + `<div class="gq-consent-preferences__actions">` + (optional ? `<button type="button" class="gq-consent-button gq-consent-button--choice" data-gq-consent-reject-all>${escapeHtml(copy.rejectAll)}</button><button type="button" class="gq-consent-button gq-consent-button--choice" data-gq-consent-accept-all>${escapeHtml(copy.acceptAll)}</button><button type="button" class="gq-consent-button gq-consent-button--secondary" data-gq-consent-save>${escapeHtml(copy.save)}</button>` : "") + `<button type="button" class="gq-consent-button gq-consent-button--secondary" data-gq-consent-close>${escapeHtml(copy.close)}</button></div></form></dialog>`),
-		footer: legalFooter(input.legal, input.language),
-		bannerOpen
-	};
-}
-/**
-* The default stylesheet. Sites restyle it through these custom properties or
-* their own CSS (CN-C4); the two first-layer choices share one class so they
-* keep equal prominence.
-*/
-const CONSENT_STYLES = `
-.gq-consent-banner{position:fixed;inset:auto 1rem 1rem 1rem;z-index:2147483000;max-width:44rem;margin:0 auto;padding:1.25rem;background:var(--gq-consent-background,#fff);color:var(--gq-consent-color,#111);border:1px solid var(--gq-consent-border,#888);border-radius:var(--gq-consent-radius,.5rem);box-shadow:0 .5rem 2rem rgba(0,0,0,.2);font:inherit}
-.gq-consent-banner[hidden]{display:none}
-.gq-consent-banner__title,.gq-consent-preferences h2{margin:0 0 .5rem;font-size:1.125rem}
-.gq-consent-banner__actions,.gq-consent-preferences__actions,.gq-consent-embed__actions{display:flex;flex-wrap:wrap;gap:.5rem;margin-top:1rem}
-.gq-consent-button{font:inherit;cursor:pointer;padding:.6rem 1rem;border-radius:var(--gq-consent-radius,.5rem);border:2px solid var(--gq-consent-accent,#111)}
-.gq-consent-button--choice{flex:1 1 10rem;background:var(--gq-consent-accent,#111);color:var(--gq-consent-accent-contrast,#fff)}
-.gq-consent-button--secondary{background:transparent;color:inherit}
-.gq-consent-button:focus-visible,.gq-consent-settings:focus-visible{outline:3px solid var(--gq-consent-focus,#1a73e8);outline-offset:2px}
-.gq-consent-preferences{max-width:40rem;width:calc(100% - 2rem);max-height:calc(100vh - 2rem);overflow:auto;padding:1.25rem;border:1px solid var(--gq-consent-border,#888);border-radius:var(--gq-consent-radius,.5rem);background:var(--gq-consent-background,#fff);color:var(--gq-consent-color,#111)}
-.gq-consent-category{border:1px solid var(--gq-consent-border,#ccc);border-radius:.375rem;margin:.75rem 0;padding:.75rem}
-.gq-consent-services{margin:.5rem 0 0;padding-left:1rem;font-size:.875rem}
-.gq-consent-services dl{display:grid;grid-template-columns:max-content 1fr;gap:.125rem .5rem;margin:.25rem 0}
-.gq-consent-services dd{margin:0}
-.gq-consent-embed{position:relative;display:flex;align-items:center;justify-content:center;width:100%;min-height:12rem;background:var(--gq-consent-embed-background,#eee);color:var(--gq-consent-color,#111)}
-.gq-consent-embed[data-gq-loaded]{display:block;min-height:0;background:none}
-.gq-consent-embed[data-gq-loaded]>iframe{width:100%;height:100%;border:0}
-.gq-consent-embed--decorative{position:absolute;inset:0;min-height:0;background:none}
-.gq-consent-embed__notice{max-width:32rem;padding:1rem;text-align:center}
-.gq-consent-blocked{padding:1rem;background:var(--gq-consent-embed-background,#eee)}
-.gq-legal ul{display:flex;flex-wrap:wrap;gap:.5rem 1rem;list-style:none;margin:0;padding:0}
-.gq-consent-settings{font:inherit;color:inherit;background:none;border:0;padding:0;text-decoration:underline;cursor:pointer}
-`.trim();
-//#endregion
+import { CONSENT_STYLES, consentPage, legalFooter } from "./consent-html.js";
 export { CONSENT_STYLES, consentPage, legalFooter };

package/dist/consent-html.d.ts

@@ -0,0 +1,36 @@
+import { r as ConsentConfiguration } from "./configuration-C_JGygQI.js";
+import { r as LegalLanguage } from "./legal-C5Xiq59W.js";
+//#region frontend/src/consent/html.d.ts
+export interface ConsentPageInput {
+  configuration: ConsentConfiguration;
+  /** The page's `lang` (BCP 47): the UI follows it (CN-C3). */
+  language: string;
+  /** The page language's Legal Contract, from the chrome (LEGAL-1); null when not delivered yet. */
+  legal?: LegalLanguage | null;
+  /** The request's Cookie header: the banner is rendered open only without a decision in force. */
+  cookie?: string | null;
+  now?: number;
+  /** Include the default stylesheet (Sites restyle through its custom properties). */
+  styles?: boolean;
+}
+export interface ConsentPage {
+  /** For `<head>`: the configuration the client reads, and the default styles. */
+  head: string;
+  /** For the start of `<body>`: the banner (first in focus order) and the preferences dialog. */
+  body: string;
+  /** For the footer: the legal links and the persistent "Cookie settings" control. */
+  footer: string;
+  /** Whether the banner is rendered open. */
+  bannerOpen: boolean;
+}
+/** The legal links and "Cookie settings" control for a footer (LG-R5, CN-R6). */
+export declare function legalFooter(legal: LegalLanguage | null | undefined, language: string): string;
+/** Everything the default UI renders on one page. */
+export declare function consentPage(input: ConsentPageInput): ConsentPage;
+/**
+ * The default stylesheet. Sites restyle it through these custom properties or
+ * their own CSS (CN-C4); the two first-layer choices share one class so they
+ * keep equal prominence.
+ */
+export declare const CONSENT_STYLES: string;
+//#endregion

package/dist/consent-html.js

@@ -0,0 +1,94 @@
+import { S as SERVICE_CATALOG, T as copyLanguage, c as grantedCategories, d as promptReason, f as readConsentCookie, x as OPTIONAL_CATEGORIES } from "./state-BYWc5TUB.js";
+import { a as CONSENT_COPY, c as legalRevisions, r as escapeHtml } from "./embeds-CJJemAmE.js";
+import { t as CONSENT_UI_VERSION } from "./version-CmdZGJvZ.js";
+import { t as CONSENT_CONFIG_ID } from "./client-config-B3LNSOxl.js";
+import { t as CONSENT_PATH } from "./paths-Cmzzof3v.js";
+//#region frontend/src/consent/html.ts
+function storageText(service, language) {
+	const copy = CONSENT_COPY[language];
+	return service.storage.map((item) => `${item.name}${item.match === "prefix" ? "*" : ""} (${item.kind}, ${item.duration[language]}${item.party === "third" ? `; ${copy.thirdPartyStorage}` : ""})`).join("; ");
+}
+function serviceList(services, language) {
+	if (!services.length) return "";
+	const copy = CONSENT_COPY[language];
+	return `<ul class="gq-consent-services">${services.map((service) => {
+		const storage = storageText(service, language);
+		return `<li class="gq-consent-service"><strong>${escapeHtml(service.name)}</strong><dl><dt>${escapeHtml(copy.provider)}</dt><dd>${escapeHtml(service.provider)}</dd><dt>${escapeHtml(copy.purpose)}</dt><dd>${escapeHtml(service.purpose[language])}</dd><dt>${escapeHtml(copy.storage)}</dt><dd>${escapeHtml(storage || "—")}</dd><dt>${escapeHtml(copy.retention)}</dt><dd>${escapeHtml(service.retention[language])}</dd></dl></li>`;
+	}).join("")}</ul>`;
+}
+function link(href, text, attributes = "") {
+	return `<a href="${escapeHtml(href)}"${attributes}>${escapeHtml(text)}</a>`;
+}
+/** The legal links and "Cookie settings" control for a footer (LG-R5, CN-R6). */
+function legalFooter(legal, language) {
+	const lang = copyLanguage(language);
+	const copy = CONSENT_COPY[lang];
+	const items = (legal?.roles ?? []).map((role) => `<li>${link(role.url, role.title ?? copy.legal[role.role] ?? role.role, ` data-gq-legal-role="${escapeHtml(role.role)}"`)}</li>`);
+	items.push(`<li><button type="button" class="gq-consent-settings" data-gq-consent-open aria-haspopup="dialog" aria-controls="gq-consent-preferences">${escapeHtml(copy.cookieSettings)}</button></li>`);
+	return `<nav class="gq-legal" aria-label="${escapeHtml(copy.legalNavigation)}"><ul>${items.join("")}</ul></nav>`;
+}
+/** Everything the default UI renders on one page. */
+function consentPage(input) {
+	const { configuration } = input;
+	const lang = copyLanguage(input.language);
+	const copy = CONSENT_COPY[lang];
+	const state = readConsentCookie(input.cookie);
+	const now = input.now ?? Date.now();
+	const bannerOpen = promptReason(configuration, state, now) !== null;
+	const inForce = grantedCategories(configuration, state, now);
+	const cookiePolicy = input.legal?.roles.find((role) => role.role === "cookie_policy");
+	const config = {
+		configuration,
+		language: input.language,
+		uiVersion: CONSENT_UI_VERSION,
+		legalRevisions: legalRevisions(input.legal),
+		endpoint: CONSENT_PATH
+	};
+	const head = `<script type="application/json" id="${CONSENT_CONFIG_ID}">${JSON.stringify(config).replaceAll("<", "\\u003c")}<\/script>` + (input.styles === false ? "" : `<style data-gq-consent-styles>${CONSENT_STYLES}</style>`);
+	const services = configuration.services.map((id) => SERVICE_CATALOG[id]);
+	const inCategory = (category) => services.filter((service) => service.category === category);
+	const optional = configuration.categories.length > 0;
+	const banner = !optional ? "" : `<section id="gq-consent-banner" class="gq-consent-banner" role="dialog" aria-modal="false" aria-labelledby="gq-consent-banner-title" aria-describedby="gq-consent-banner-text" lang="${escapeHtml(input.language)}"${bannerOpen ? "" : " hidden"}><h2 id="gq-consent-banner-title" class="gq-consent-banner__title">${escapeHtml(copy.bannerTitle)}</h2><p id="gq-consent-banner-text" class="gq-consent-banner__text">${escapeHtml(copy.bannerText)}` + (cookiePolicy ? ` ${link(cookiePolicy.url, copy.cookiePolicy, " class=\"gq-consent-banner__policy\"")}` : "") + `</p><div class="gq-consent-banner__actions"><button type="button" class="gq-consent-button gq-consent-button--choice" data-gq-consent-reject-all>${escapeHtml(copy.rejectAll)}</button><button type="button" class="gq-consent-button gq-consent-button--choice" data-gq-consent-accept-all>${escapeHtml(copy.acceptAll)}</button><button type="button" class="gq-consent-button gq-consent-button--secondary" data-gq-consent-customise aria-haspopup="dialog" aria-controls="gq-consent-preferences">${escapeHtml(copy.customise)}</button></div></section>`;
+	const necessary = copy.categories.necessary;
+	const categories = OPTIONAL_CATEGORIES.filter((category) => configuration.categories.includes(category)).map((category) => {
+		const text = copy.categories[category];
+		const id = `gq-consent-category-${category}`;
+		return `<fieldset class="gq-consent-category"><legend>${escapeHtml(text.name)}</legend><label for="${id}"><input type="checkbox" id="${id}" name="${category}" value="${category}" data-gq-consent-category${inForce.includes(category) ? " checked" : ""}> ${escapeHtml(text.name)}</label><p>${escapeHtml(text.description)}</p>${serviceList(inCategory(category), lang)}</fieldset>`;
+	});
+	return {
+		head,
+		body: banner + (`<dialog id="gq-consent-preferences" class="gq-consent-preferences" aria-labelledby="gq-consent-preferences-title" lang="${escapeHtml(input.language)}"><form method="dialog"><h2 id="gq-consent-preferences-title">${escapeHtml(copy.preferencesTitle)}</h2><p>${escapeHtml(copy.preferencesText)}</p>` + (cookiePolicy ? `<p>${link(cookiePolicy.url, copy.cookiePolicy)}</p>` : "") + `<fieldset class="gq-consent-category"><legend>${escapeHtml(necessary.name)}</legend><p>${escapeHtml(copy.alwaysOn)}. ${escapeHtml(necessary.description)}</p>${serviceList(inCategory("necessary"), lang)}</fieldset>` + categories.join("") + (optional ? `<p class="gq-consent-id">${escapeHtml(copy.consentId)}: <code data-gq-consent-id data-gq-consent-none="${escapeHtml(copy.noDecision)}">${escapeHtml(state?.consentId ?? copy.noDecision)}</code></p>` : "") + `<div class="gq-consent-preferences__actions">` + (optional ? `<button type="button" class="gq-consent-button gq-consent-button--choice" data-gq-consent-reject-all>${escapeHtml(copy.rejectAll)}</button><button type="button" class="gq-consent-button gq-consent-button--choice" data-gq-consent-accept-all>${escapeHtml(copy.acceptAll)}</button><button type="button" class="gq-consent-button gq-consent-button--secondary" data-gq-consent-save>${escapeHtml(copy.save)}</button>` : "") + `<button type="button" class="gq-consent-button gq-consent-button--secondary" data-gq-consent-close>${escapeHtml(copy.close)}</button></div></form></dialog>`),
+		footer: legalFooter(input.legal, input.language),
+		bannerOpen
+	};
+}
+/**
+* The default stylesheet. Sites restyle it through these custom properties or
+* their own CSS (CN-C4); the two first-layer choices share one class so they
+* keep equal prominence.
+*/
+const CONSENT_STYLES = `
+.gq-consent-banner{position:fixed;inset:auto 1rem 1rem 1rem;z-index:2147483000;max-width:44rem;margin:0 auto;padding:1.25rem;background:var(--gq-consent-background,#fff);color:var(--gq-consent-color,#111);border:1px solid var(--gq-consent-border,#888);border-radius:var(--gq-consent-radius,.5rem);box-shadow:0 .5rem 2rem rgba(0,0,0,.2);font:inherit}
+.gq-consent-banner[hidden]{display:none}
+.gq-consent-banner__title,.gq-consent-preferences h2{margin:0 0 .5rem;font-size:1.125rem}
+.gq-consent-banner__actions,.gq-consent-preferences__actions,.gq-consent-embed__actions{display:flex;flex-wrap:wrap;gap:.5rem;margin-top:1rem}
+.gq-consent-button{font:inherit;cursor:pointer;padding:.6rem 1rem;border-radius:var(--gq-consent-radius,.5rem);border:2px solid var(--gq-consent-accent,#111)}
+.gq-consent-button--choice{flex:1 1 10rem;background:var(--gq-consent-accent,#111);color:var(--gq-consent-accent-contrast,#fff)}
+.gq-consent-button--secondary{background:transparent;color:inherit}
+.gq-consent-button:focus-visible,.gq-consent-settings:focus-visible{outline:3px solid var(--gq-consent-focus,#1a73e8);outline-offset:2px}
+.gq-consent-preferences{max-width:40rem;width:calc(100% - 2rem);max-height:calc(100vh - 2rem);overflow:auto;padding:1.25rem;border:1px solid var(--gq-consent-border,#888);border-radius:var(--gq-consent-radius,.5rem);background:var(--gq-consent-background,#fff);color:var(--gq-consent-color,#111)}
+.gq-consent-category{border:1px solid var(--gq-consent-border,#ccc);border-radius:.375rem;margin:.75rem 0;padding:.75rem}
+.gq-consent-services{margin:.5rem 0 0;padding-left:1rem;font-size:.875rem}
+.gq-consent-services dl{display:grid;grid-template-columns:max-content 1fr;gap:.125rem .5rem;margin:.25rem 0}
+.gq-consent-services dd{margin:0}
+.gq-consent-embed{position:relative;display:flex;align-items:center;justify-content:center;width:100%;min-height:12rem;background:var(--gq-consent-embed-background,#eee);color:var(--gq-consent-color,#111)}
+.gq-consent-embed[data-gq-loaded]{display:block;min-height:0;background:none}
+.gq-consent-embed[data-gq-loaded]>iframe{width:100%;height:100%;border:0}
+.gq-consent-embed--decorative{position:absolute;inset:0;min-height:0;background:none}
+.gq-consent-embed__notice{max-width:32rem;padding:1rem;text-align:center}
+.gq-consent-blocked{padding:1rem;background:var(--gq-consent-embed-background,#eee)}
+.gq-legal ul{display:flex;flex-wrap:wrap;gap:.5rem 1rem;list-style:none;margin:0;padding:0}
+.gq-consent-settings{font:inherit;color:inherit;background:none;border:0;padding:0;text-decoration:underline;cursor:pointer}
+`.trim();
+//#endregion
+export { CONSENT_STYLES, consentPage, legalFooter };

package/dist/consent-server.d.ts

@@ -45,6 +45,13 @@ export interface ConsentServerConfig {
    * request's own origin is always accepted.
    */
   siteOrigins?: readonly string[];
+  /**
+   * The reverse proxies the Site runs in front of the Worker, as IPv4/IPv6
+   * addresses or CIDRs. Only a request whose `CF-Connecting-IP` is one of
+   * them has its client IP taken from the proxy's `X-Forwarded-For` /
+   * `X-Real-IP` (docs/client-ip.md).
+   */
+  trustedProxies?: readonly string[];
   /** Retention after a decision stops being in force; at most (and by default) 5 years (CN-R10). */
   retentionDays?: number;
   now?: () => number;

package/dist/consent-server.js

@@ -2,7 +2,7 @@ import { t as bearerMatches } from "./bearer-DMOCoSci.js";
 import { i as DECISION_VALIDITY_MS, l as isConsentId, t as CONSENT_ACTIONS, x as OPTIONAL_CATEGORIES } from "./state-BYWc5TUB.js";
 import { a as parseConsentRecordRequest, t as MAX_RECORD_BYTES } from "./records-Dumrz759.js";
 import { t as CONSENT_PATH } from "./paths-Cmzzof3v.js";
-import { n as readBoundedBody, t as isSameOrigin } from "./request-guards-BUPr_vA4.js";
+import { i as readBoundedBody, n as rateLimitKey, r as isSameOrigin, t as clientAddressResolver } from "./client-ip-cnqPLdDa.js";
 //#region frontend/src/consent/server.ts
 const MAX_RETENTION_DAYS = 1826;
 const DAY_MS = 864e5;
@@ -73,6 +73,7 @@ function createConsentServer(config) {
 	if (!Number.isInteger(retentionDays) || retentionDays < 1 || retentionDays > 1826) throw new Error(`retentionDays must be a whole number of days from 1 to ${MAX_RETENTION_DAYS}`);
 	const now = config.now ?? Date.now;
 	const origins = new Set((config.siteOrigins ?? []).map((origin) => new URL(origin).origin));
+	const clientAddress = clientAddressResolver(config.trustedProxies);
 	/** CN-R9: same-origin only. A browser's cross-site post carries its Origin. */
 	const sameOrigin = (request) => isSameOrigin(request, origins);
 	const readBody = (request) => readBoundedBody(request, MAX_RECORD_BYTES);
@@ -90,7 +91,7 @@ function createConsentServer(config) {
 		const bindings = await config.bindings();
 		const limiter = bindings.CONSENT_RATE_LIMITER;
 		if (limiter) {
-			const key = request.headers.get("CF-Connecting-IP") ?? "unknown";
+			const key = rateLimitKey(clientAddress(request));
 			const { success } = await limiter.limit({ key });
 			if (!success) return json(429, { error: "Too many consent records; try again later." });
 		}

package/dist/consent.js

@@ -1,5 +1,5 @@
 import { C as SERVICE_IDS, D as hostMatches, E as embedService, O as hostService, S as SERVICE_CATALOG, T as copyLanguage, _ as consentConfiguration, a as consentCookie, b as COPY_LANGUAGES, c as grantedCategories, d as promptReason, f as readConsentCookie, g as MEASUREMENT_ID, h as CONSENT_COPY_REVISION, i as DECISION_VALIDITY_MS, k as isServiceId, l as isConsentId, m as serviceGranted, n as CONSENT_COOKIE, o as decide, p as serializeConsentState, r as CONSENT_COOKIE_MAX_AGE_SECONDS, s as denyAll, t as CONSENT_ACTIONS, u as parseConsentState, v as needsBanner, w as catalogService, x as OPTIONAL_CATEGORIES, y as CONSENT_CATEGORIES } from "./state-BYWc5TUB.js";
 import { a as parseConsentRecordRequest, i as isRecordToken, n as consentRecordRequest, r as isLegalRoleName, t as MAX_RECORD_BYTES } from "./records-Dumrz759.js";
 import { a as CONSENT_COPY, c as legalRevisions, i as rewriteEmbeds, l as parseLegalLanguage, n as embedPlaceholder, o as LEGAL_ROLES, r as escapeHtml, s as REQUIRED_LEGAL_ROLES, t as blockedPlaceholder } from "./embeds-CJJemAmE.js";
-import { t as CONSENT_UI_VERSION } from "./version-Co2JJcK_.js";
+import { t as CONSENT_UI_VERSION } from "./version-CmdZGJvZ.js";
 export { CONSENT_ACTIONS, CONSENT_CATEGORIES, CONSENT_COOKIE, CONSENT_COOKIE_MAX_AGE_SECONDS, CONSENT_COPY, CONSENT_COPY_REVISION, CONSENT_UI_VERSION, COPY_LANGUAGES, DECISION_VALIDITY_MS, LEGAL_ROLES, MAX_RECORD_BYTES, MEASUREMENT_ID, OPTIONAL_CATEGORIES, REQUIRED_LEGAL_ROLES, SERVICE_CATALOG, SERVICE_IDS, blockedPlaceholder, catalogService, consentConfiguration, consentCookie, consentRecordRequest, copyLanguage, decide, denyAll, embedPlaceholder, embedService, escapeHtml, grantedCategories, hostMatches, hostService, isConsentId, isLegalRoleName, isRecordToken, isServiceId, legalRevisions, needsBanner, parseConsentRecordRequest, parseConsentState, parseLegalLanguage, promptReason, readConsentCookie, rewriteEmbeds, serializeConsentState, serviceGranted };