@gradial/aci 0.1.38 → 0.1.40

package/CHANGELOG.md

@@ -0,0 +1,26 @@
+# Changelog
+
+## 0.1.40 - 2026-07-21
+
+### Added
+
+- First-party consent banner component (`mountConsentBanner`) for sites without
+  an external CMP. Checks for the `aci_consent` cookie, renders a banner with
+  accept/reject buttons, and calls `applyConsent()` on user decision.
+- `ConsentBanner.astro` wrapper component for Astro sites, importable from
+  `@gradial/aci/astro/ConsentBanner`.
+- Base CSS styles for the consent banner in `@gradial/aci/consent-banner/styles.css`.
+  Sites override with their own CSS.
+
+## 0.1.34 - 2026-07-20
+
+### Fixed
+
+- Preserve layout-default fragment references during `aci content compile`, so
+  shared site chrome such as navigation and footers is not silently omitted.
+- Reject malformed or dangling layout-default fragment references before local
+  compilation or managed publishing can produce or stage invalid artifacts.
+
+After upgrading, delete any `.aci/compiled` directory produced by an older
+compiler and rerun `aci content compile`. Existing compiled output is derived
+state and is not repaired in place.

package/dist/consent-banner/index.d.ts

@@ -0,0 +1,33 @@
+export interface ConsentBannerOptions {
+    /** Heading text. Default: "Privacy" */
+    heading?: string;
+    /** Body text explaining what the user is consenting to. */
+    message?: string;
+    /** Label for the accept button. Default: "Accept" */
+    acceptLabel?: string;
+    /** Label for the reject button. Default: "Reject" */
+    rejectLabel?: string;
+    /** Label for a link to the privacy policy. Optional. */
+    privacyPolicyLabel?: string;
+    /** URL to the privacy policy. Optional. */
+    privacyPolicyHref?: string;
+    /** Source identifier written to the cookie envelope. Default: "banner" */
+    source?: string;
+    /** Callback fired after a consent decision is written. */
+    onDecision?: (granted: boolean) => void;
+}
+/**
+ * hasConsentCookie returns true when the aci_consent cookie exists (the user
+ * has already made a decision, regardless of whether they granted or denied).
+ */
+export declare function hasConsentCookie(doc: {
+    cookie: string;
+}): boolean;
+/**
+ * mountConsentBanner checks for an existing consent cookie. If none exists,
+ * it injects a banner into the document body and wires up accept/reject
+ * buttons. If a cookie already exists, it does nothing (idempotent).
+ *
+ * Returns a cleanup function that removes the banner and event listeners.
+ */
+export declare function mountConsentBanner(doc: Document, opts?: ConsentBannerOptions): () => void;

package/dist/consent-banner/index.js

@@ -0,0 +1,99 @@
+// First-party consent banner (design/04, preset="manual"): a self-contained
+// client-side component for sites that don't have an external CMP (c15t,
+// OneTrust, etc.). Checks for the aci_consent cookie, shows a banner if
+// absent, and calls applyConsent() on user decision.
+//
+// The banner is framework-agnostic — it renders plain DOM and is driven by
+// CSS classes so each site can style it. The Astro wrapper component
+// (packages/sdk/src/astro/ConsentBanner.astro) imports and invokes this,
+// then applies site-specific styles.
+import { applyConsent, readConsentCookie, PERSONALIZATION_PURPOSE, } from "../collect/consent/envelope.js";
+const DEFAULTS = {
+    heading: "Privacy",
+    message: "We use cookies to personalize content and improve your experience. You can accept or reject personalization.",
+    acceptLabel: "Accept",
+    rejectLabel: "Reject",
+    source: "banner",
+};
+const BANNER_ID = "aci-consent-banner";
+const BANNER_ATTR = "data-aci-consent-banner";
+const BANNER_HIDDEN = "aci-consent-banner--hidden";
+/**
+ * hasConsentCookie returns true when the aci_consent cookie exists (the user
+ * has already made a decision, regardless of whether they granted or denied).
+ */
+export function hasConsentCookie(doc) {
+    return readConsentCookie(doc) !== undefined;
+}
+/**
+ * mountConsentBanner checks for an existing consent cookie. If none exists,
+ * it injects a banner into the document body and wires up accept/reject
+ * buttons. If a cookie already exists, it does nothing (idempotent).
+ *
+ * Returns a cleanup function that removes the banner and event listeners.
+ */
+export function mountConsentBanner(doc, opts = {}) {
+    if (hasConsentCookie(doc))
+        return () => { };
+    if (doc.getElementById(BANNER_ID))
+        return () => { };
+    const config = { ...DEFAULTS, ...opts };
+    const banner = createBannerElement(config, doc);
+    doc.body.appendChild(banner);
+    const cleanup = () => {
+        banner.remove();
+    };
+    const decide = (granted) => {
+        const purposes = granted ? [PERSONALIZATION_PURPOSE] : [];
+        applyConsent(purposes, config.source, { document: doc });
+        banner.classList.add(BANNER_HIDDEN);
+        setTimeout(cleanup, 300);
+        opts.onDecision?.(granted);
+    };
+    banner.querySelector("[data-aci-consent-accept]")?.addEventListener("click", () => decide(true));
+    banner.querySelector("[data-aci-consent-reject]")?.addEventListener("click", () => decide(false));
+    return cleanup;
+}
+function createBannerElement(config, doc) {
+    const banner = doc.createElement("div");
+    banner.id = BANNER_ID;
+    banner.setAttribute(BANNER_ATTR, "");
+    banner.className = BANNER_ID;
+    const content = doc.createElement("div");
+    content.className = `${BANNER_ID}__content`;
+    const text = doc.createElement("div");
+    text.className = `${BANNER_ID}__text`;
+    const heading = doc.createElement("p");
+    heading.className = `${BANNER_ID}__heading`;
+    heading.textContent = config.heading;
+    text.appendChild(heading);
+    const message = doc.createElement("p");
+    message.className = `${BANNER_ID}__message`;
+    message.textContent = config.message;
+    text.appendChild(message);
+    if (config.privacyPolicyHref && config.privacyPolicyLabel) {
+        const link = doc.createElement("a");
+        link.className = `${BANNER_ID}__privacy-link`;
+        link.href = config.privacyPolicyHref;
+        link.textContent = config.privacyPolicyLabel;
+        text.appendChild(link);
+    }
+    content.appendChild(text);
+    const actions = doc.createElement("div");
+    actions.className = `${BANNER_ID}__actions`;
+    const rejectBtn = doc.createElement("button");
+    rejectBtn.type = "button";
+    rejectBtn.className = `${BANNER_ID}__btn ${BANNER_ID}__btn--reject`;
+    rejectBtn.setAttribute("data-aci-consent-reject", "");
+    rejectBtn.textContent = config.rejectLabel;
+    actions.appendChild(rejectBtn);
+    const acceptBtn = doc.createElement("button");
+    acceptBtn.type = "button";
+    acceptBtn.className = `${BANNER_ID}__btn ${BANNER_ID}__btn--accept`;
+    acceptBtn.setAttribute("data-aci-consent-accept", "");
+    acceptBtn.textContent = config.acceptLabel;
+    actions.appendChild(acceptBtn);
+    content.appendChild(actions);
+    banner.appendChild(content);
+    return banner;
+}

package/dist/index.d.ts

@@ -15,3 +15,4 @@ export { AssetSchema, isImage, isAsset, } from './types/media.js';
 export * from './audience-data-models.js';
 export * from './define-data-model.js';
 export * from './types/index.js';
+export { mountConsentBanner, hasConsentCookie, type ConsentBannerOptions, } from './consent-banner/index.js';

package/dist/index.js

@@ -9,6 +9,7 @@ export { AssetSchema, isImage, isAsset, } from './types/media.js';
 export * from './audience-data-models.js';
 export * from './define-data-model.js';
 export * from './types/index.js';
+export { mountConsentBanner, hasConsentCookie, } from './consent-banner/index.js';
 // Note: content/ is NOT re-exported here because it imports node:path,
 // making it incompatible with client-side bundlers. Import server-only
 // content utilities from '@gradial/aci/content' explicitly.

package/dist/next/middleware.d.ts

@@ -1,19 +1,11 @@
 import { type NextRequest } from 'next/server.js';
 export interface GradialMiddlewareConfig {
-    /**
-     * Site identity for this deployment. Env-injected identity is valid —
-     * the platform sets ACI_SITE_ID per deployment, so passing a bare
-     * `process.env.ACI_SITE_ID` (which types as `string | undefined`) is
-     * supported. A missing value 500s cleanly at runtime
-     * ("ACI site id is not configured").
-     */
-    siteId: string | undefined;
     edgeConfig?: string;
     previewSignKey?: string;
     deploymentId?: string;
     deploymentProtectionBypass?: string;
 }
-export declare function createGradialMiddleware(config: GradialMiddlewareConfig): (request: NextRequest) => Promise<Response>;
+export declare function createGradialMiddleware(config?: GradialMiddlewareConfig): (request: NextRequest) => Promise<Response>;
 export declare const aciMiddlewareMatcher: string[];
 export declare const config: {
     matcher: string[];

package/dist/next/middleware.js

@@ -10,7 +10,7 @@ const PASSTHROUGH_ROUTES = (typeof __ACI_PASSTHROUGH_ROUTES__ !== 'undefined' ?
 const ASSET_PREFIX = typeof __ACI_ASSET_PREFIX__ !== 'undefined'
     ? __ACI_ASSET_PREFIX__
     : '/.gradial-dam';
-export function createGradialMiddleware(config) {
+export function createGradialMiddleware(config = {}) {
     return async function middleware(request) {
         const url = request.nextUrl;
         // ?leave_preview=1 → clear cookies, redirect to clean URL
@@ -185,8 +185,8 @@ async function activeReleaseFromEdgeConfig(config) {
         return active.releaseId;
     return clampRelease(active.releaseId, active.sequence || 0, compatibility);
 }
-function siteIdForConfig(config) {
-    return config.siteId ?? '';
+function siteIdForConfig(_config) {
+    return process.env.ACI_SITE_ID || '';
 }
 async function getEdgeConfigJSON(edgeConfig, key) {
     const value = await getEdgeConfigValue(edgeConfig, key);

package/dist/react/VideoPlayer.d.ts

@@ -16,10 +16,10 @@ export declare function VideoPlayer({ video, ...attrs }: VideoPlayerProps): impo
     title: string;
     rel?: string | undefined | undefined;
     content?: string | undefined | undefined;
-    dir?: string | undefined | undefined;
-    hidden?: boolean | undefined | undefined;
     slot?: string | undefined | undefined;
     style?: import("react").CSSProperties | undefined;
+    dir?: string | undefined | undefined;
+    hidden?: boolean | undefined | undefined;
     children?: import("react").ReactNode;
     className?: string | undefined | undefined;
     crossOrigin?: "" | "anonymous" | "use-credentials" | undefined;

package/dist/react/index.d.ts

@@ -25,10 +25,10 @@ export declare function Image({ image, value, ...attrs }: ImageProps): import("r
     rel?: string | undefined | undefined;
     content?: string | undefined | undefined;
     referrerPolicy?: import("react").HTMLAttributeReferrerPolicy | undefined;
-    dir?: string | undefined | undefined;
-    hidden?: boolean | undefined | undefined;
     slot?: string | undefined | undefined;
     style?: import("react").CSSProperties | undefined;
+    dir?: string | undefined | undefined;
+    hidden?: boolean | undefined | undefined;
     children?: ReactNode;
     className?: string | undefined | undefined;
     crossOrigin?: "" | "anonymous" | "use-credentials" | undefined;

package/dist/testing/conformance/checks.js

@@ -89,17 +89,25 @@ function walkFiles(dir, predicate) {
 // ---------------------------------------------------------------------------
 export function checkConfig(ctx) {
     const results = [];
-    // Env-only site identity: in siteIdMode 'env' the platform owns tenant
-    // identity (terraform injects ACI_SITE_ID per deployment), so .aci.yaml
-    // must not carry a siteId at all — a leftover label pins the repo to one
-    // site and drifts silently from the deployed identity.
-    if (ctx.siteIdMode === 'env') {
+    // Validate .aci.yaml siteId: when ctx.siteId is provided, verify it matches;
+    // when not provided, verify .aci.yaml does not pin a siteId at all.
+    {
         const aciYaml = readTextFile(join(ctx.rootDir, '.aci.yaml'));
         if (aciYaml !== null) {
-            const pinsSiteId = /^siteId\s*:/m.test(aciYaml);
-            results.push(!pinsSiteId
-                ? ok('config', '.aci.yaml does not pin a siteId (env-only identity)')
-                : fail('config', '.aci.yaml does not pin a siteId (env-only identity)', '.aci.yaml declares siteId but this repo uses siteIdMode "env": the platform owns site identity (ACI_SITE_ID is injected per deployment), so the manifest must not pin a site — delete the siteId line'));
+            const siteIdMatch = aciYaml.match(/^siteId\s*:\s*["']?([^"'\n]+)["']?\s*$/m);
+            if (ctx.siteId) {
+                const declared = siteIdMatch ? siteIdMatch[1].trim() : null;
+                results.push(declared === ctx.siteId
+                    ? ok('config', '.aci.yaml siteId matches expected value')
+                    : fail('config', '.aci.yaml siteId matches expected value', declared
+                        ? `.aci.yaml siteId is '${declared}' but expected '${ctx.siteId}'`
+                        : `.aci.yaml is missing siteId (expected '${ctx.siteId}')`));
+            }
+            else {
+                results.push(!siteIdMatch
+                    ? ok('config', '.aci.yaml does not pin a siteId')
+                    : fail('config', '.aci.yaml does not pin a siteId', '.aci.yaml declares siteId but no expected value was provided — either pass siteId to the preset or remove it from .aci.yaml'));
+            }
         }
     }
     if (ctx.framework === 'next') {
@@ -255,65 +263,16 @@ export function checkMiddleware(ctx) {
     results.push(usesSDKMiddleware
         ? ok('middleware', 'middleware uses createGradialMiddleware', rel)
         : fail('middleware', 'middleware uses createGradialMiddleware', rel + ' should use createGradialMiddleware from @gradial/aci/next/middleware'));
-    // Check that the siteId passed to createGradialMiddleware is canonical.
-    // Accepted forms depend on ctx.siteIdMode (default 'literal'):
-    //
-    // 'literal':
-    //   (a) a string literal exactly equal to ctx.siteId (the tenant's
-    //       canonical site id) — this is what the template stamps;
-    //   (b) process.env.ACI_SITE_ID || '<literal>' (or ?? instead of ||)
-    //       where the literal default is exactly ctx.siteId — the
-    //       multi-tenant/dev-mirror form: the deployment env supplies the
-    //       per-tenant identity, the default keeps local dev correct.
-    //
-    // 'env' (tenant-agnostic repos deployed to multiple sites): the ONLY
-    //   accepted form is exactly `siteId: process.env.ACI_SITE_ID`. The
-    //   platform owns tenant identity — terraform sets ACI_SITE_ID on every
-    //   deployment — and the runtime 500s cleanly if it is missing, so any
-    //   literal, fallback (|| / ??), other env var name, or computed
-    //   expression fails.
-    //
-    // Anything else (placeholder literal, wrong/missing default, other env
-    // var names, computed expressions) fails: a wrong siteId means the edge
-    // release-pointer key never matches and every live route 503s.
-    const siteIdMode = ctx.siteIdMode ?? 'literal';
-    if (siteIdMode === 'env') {
-        const label = 'middleware configures canonical siteId';
-        // Narrow the search to the createGradialMiddleware call when present so
-        // an unrelated siteId reference elsewhere in the file can't satisfy us.
-        const callIdx = middlewareFile.content.indexOf('createGradialMiddleware(');
-        const region = callIdx >= 0 ? middlewareFile.content.slice(callIdx) : middlewareFile.content;
-        // Exactly `siteId: process.env.ACI_SITE_ID` followed by the end of the
-        // property (`,` or `}`) — same object-property shape the literal-mode
-        // regexes target, but with nothing allowed after the env access.
-        const bareEnv = /siteId\s*:\s*process\.env\.ACI_SITE_ID\s*(?=[,}])/.test(region);
-        results.push(bareEnv
-            ? ok('middleware', label, `${rel} (env-only siteId)`)
-            : fail('middleware', label, `${rel}: middleware must read siteId only from process.env.ACI_SITE_ID (no literal or fallback) — the platform owns tenant identity and injects ACI_SITE_ID per deployment`));
-    }
-    else if (ctx.siteId) {
-        const label = 'middleware configures canonical siteId';
-        const expected = ctx.siteId;
-        const acceptedForms = `accepted forms: siteId: '${expected}' or ` +
-            `siteId: process.env.ACI_SITE_ID || '${expected}' (?? also accepted)`;
-        // Narrow the search to the createGradialMiddleware call when present so
-        // an unrelated siteId reference elsewhere in the file can't satisfy us.
+    // Middleware must NOT pass a siteId — the SDK reads process.env.ACI_SITE_ID
+    // internally. Any siteId arg is stale config that should be removed.
+    {
+        const label = 'middleware does not pass siteId';
         const callIdx = middlewareFile.content.indexOf('createGradialMiddleware(');
         const region = callIdx >= 0 ? middlewareFile.content.slice(callIdx) : middlewareFile.content;
-        // Form (b): process.env.ACI_SITE_ID || '<default>' (or ??).
-        const envMatch = region.match(/siteId\s*:\s*process\.env\.ACI_SITE_ID\s*(?:\|\||\?\?)\s*(['"`])((?:(?!\1).)*)\1/);
-        // Form (a): bare string literal (single/double quotes or backticks).
-        const literalMatch = region.match(/siteId\s*:\s*(['"`])((?:(?!\1).)*)\1/);
-        const configured = envMatch ? envMatch[2] : literalMatch ? literalMatch[2] : null;
-        if (configured === expected) {
-            results.push(ok('middleware', label, `${rel} (${envMatch ? 'env with canonical default' : 'canonical literal'})`));
-        }
-        else if (configured !== null) {
-            results.push(fail('middleware', label, `${rel}: siteId ${envMatch ? 'default ' : ''}is '${configured}' but the canonical site id is '${expected}'; ${acceptedForms}`));
-        }
-        else {
-            results.push(fail('middleware', label, `${rel}: siteId passed to createGradialMiddleware is not an accepted form (placeholder/computed expressions, other env vars, and process.env.ACI_SITE_ID without a literal default all fail); ${acceptedForms}`));
-        }
+        const passesSiteId = /siteId\s*:/.test(region);
+        results.push(!passesSiteId
+            ? ok('middleware', label, rel)
+            : fail('middleware', label, `${rel}: remove siteId from createGradialMiddleware() — the SDK reads process.env.ACI_SITE_ID internally; the platform injects it per deployment`));
     }
     // Check that the middleware matcher is inlined (not imported) and matches
     // the SDK's canonical value. Next.js requires config.matcher to be

package/dist/testing/conformance/preset.js

@@ -56,11 +56,8 @@ function resolveChecks(input) {
 export function runConformanceChecks(options) {
     const ctx = {
         framework: options.framework,
-        // 'env' mode carries no site identity in the repo; checks never compare
-        // against a value, so the context uses the empty string.
         siteId: options.siteId ?? '',
         rootDir: options.rootDir || process.cwd(),
-        siteIdMode: options.siteIdMode || 'literal',
     };
     const checks = resolveChecks(options.checks);
     const allResults = checks.flatMap((name) => {
@@ -85,11 +82,8 @@ export function conformancePreset(options) {
     test('ACI conformance', async (t) => {
         const ctx = {
             framework: options.framework,
-            // 'env' mode carries no site identity in the repo; checks never compare
-            // against a value, so the context uses the empty string.
             siteId: options.siteId ?? '',
             rootDir: options.rootDir || process.cwd(),
-            siteIdMode: options.siteIdMode || 'literal',
         };
         for (const checkName of checks) {
             await t.test(checkName, () => {

package/dist/testing/conformance/types.d.ts

@@ -8,10 +8,27 @@
 export type ConformanceFramework = 'next' | 'astro';
 /** Individual check names that can be enabled/disabled. */
 export type ConformanceCheckName = 'config' | 'registry' | 'pageEntry' | 'middleware' | 'noFileContentProvider' | 'noCustomContent' | 'noLegacyAssetRoute' | 'buildSucceeds' | 'contentCompile' | 'sdkVersion';
-/** Options common to both siteId modes. */
-export interface ConformancePresetCommonOptions {
+/**
+ * Options for the conformance preset.
+ *
+ * Middleware must always read siteId from `process.env.ACI_SITE_ID` — the
+ * platform owns tenant identity and injects it per deployment. Literals,
+ * fallbacks (`||`/`??`), and other env var names all fail. A missing env
+ * produces a clean 500 at runtime.
+ *
+ * `siteId` is optional — when provided, .aci.yaml's siteId is validated
+ * against it. When omitted, the check verifies .aci.yaml does not pin a
+ * siteId at all.
+ */
+export interface ConformancePresetOptions {
     /** Framework the site uses. */
     framework: ConformanceFramework;
+    /**
+     * Expected canonical siteId in .aci.yaml. When provided, the config check
+     * verifies .aci.yaml declares this exact value. When omitted, the config
+     * check verifies .aci.yaml does NOT declare a siteId.
+     */
+    siteId?: string;
     /** Root directory of the site project. Defaults to process.cwd(). */
     rootDir?: string;
     /**
@@ -20,36 +37,6 @@ export interface ConformancePresetCommonOptions {
      */
     checks?: ConformanceCheckName[] | Partial<Record<ConformanceCheckName, boolean>>;
 }
-/**
- * Options for the conformance preset.
- *
- * The siteId requirement is keyed off `siteIdMode` (defaults to 'literal'):
- *
- * - 'literal': `siteId` is REQUIRED — it is the tenant's canonical site id,
- *   and the middleware must pass it as a string literal (or
- *   `process.env.ACI_SITE_ID || '<canonical>'` / `??` with the canonical
- *   literal as the default). This is what the template stamps for
- *   single-tenant repos.
- * - 'env': `siteId` is FORBIDDEN — tenant-agnostic repos deployed to
- *   multiple sites have no site identity in the repo at all. The middleware
- *   must read siteId ONLY from the environment — exactly
- *   `siteId: process.env.ACI_SITE_ID`, with no literal default, no
- *   `||`/`??` fallback, no other env var names, and no computed
- *   expressions — and `.aci.yaml` must not pin a siteId. The platform owns
- *   tenant identity and injects ACI_SITE_ID per deployment; a missing env
- *   produces a clean 500 at runtime.
- */
-export type ConformancePresetOptions = ConformancePresetCommonOptions & ({
-    /** See ConformancePresetOptions: 'literal' expects a canonical siteId in the repo. */
-    siteIdMode?: 'literal';
-    /** Expected canonical siteId value (verified in config and middleware). */
-    siteId: string;
-} | {
-    /** See ConformancePresetOptions: 'env' means the repo carries no site identity. */
-    siteIdMode: 'env';
-    /** Forbidden in env mode — the repo must not carry a site identity. */
-    siteId?: never;
-});
 /** Result of a single conformance check. */
 export interface ConformanceCheckResult {
     name: ConformanceCheckName;
@@ -68,12 +55,7 @@ export type ConformanceCheckFn = (ctx: ConformanceContext) => ConformanceCheckRe
 /** Context passed to each check function. */
 export interface ConformanceContext {
     framework: ConformanceFramework;
-    /**
-     * Canonical siteId in 'literal' mode; '' in 'env' mode (no site identity
-     * in the repo — env-mode checks never compare against a value).
-     */
+    /** Canonical siteId from options, or '' when not provided. */
     siteId: string;
     rootDir: string;
-    /** See ConformancePresetOptions.siteIdMode. Defaults to 'literal'. */
-    siteIdMode?: 'literal' | 'env';
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gradial/aci",
-  "version": "0.1.38",
+  "version": "0.1.40",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -9,9 +9,12 @@
     "bin/aci.js",
     "src/cli/*.mjs",
     "src/types/*.ts",
+    "src/astro/*.astro",
+    "src/consent-banner/*.css",
     "templates/common",
     "templates/nextjs",
     "templates/astro",
+    "CHANGELOG.md",
     "README.md"
   ],
   "bin": {
@@ -83,11 +86,26 @@
       "import": "./dist/astro/index.js",
       "default": "./dist/astro/index.js"
     },
+    "./astro/ConsentBanner": {
+      "import": "./src/astro/ConsentBanner.astro"
+    },
+    "./consent-banner": {
+      "types": "./dist/consent-banner/index.d.ts",
+      "import": "./dist/consent-banner/index.js"
+    },
     "./testing": {
       "types": "./dist/testing/conformance/index.d.ts",
       "import": "./dist/testing/conformance/index.js"
     }
   },
+  "scripts": {
+    "build": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc -p tsconfig.json",
+    "test": "node --import tsx --test \"src/**/*.test.ts\"",
+    "build:cli": "cd ../.. && ./scripts/build-cli.sh",
+    "generate-starters": "cd ../.. && tsx scripts/generate-starters.ts",
+    "compile-registry": "tsx src/cli/compile-registry.mjs",
+    "prepack": "npm run generate-starters && npm run build && node scripts/ensure-bin-modes.mjs"
+  },
   "dependencies": {
     "markdown-it": "^14.1.0",
     "sanitize-html": "^2.13.1",
@@ -127,18 +145,11 @@
     "zod": "^4.0.0"
   },
   "optionalDependencies": {
-    "@gradial/aci-cli-darwin-arm64": "0.1.38",
-    "@gradial/aci-cli-darwin-x64": "0.1.38",
-    "@gradial/aci-cli-linux-arm64": "0.1.38",
-    "@gradial/aci-cli-linux-x64": "0.1.38",
-    "@gradial/aci-cli-win32-arm64": "0.1.38",
-    "@gradial/aci-cli-win32-x64": "0.1.38"
-  },
-  "scripts": {
-    "build": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc -p tsconfig.json",
-    "test": "node --import tsx --test \"src/**/*.test.ts\"",
-    "build:cli": "cd ../.. && ./scripts/build-cli.sh",
-    "generate-starters": "cd ../.. && tsx scripts/generate-starters.ts",
-    "compile-registry": "tsx src/cli/compile-registry.mjs"
+    "@gradial/aci-cli-darwin-arm64": "0.1.40",
+    "@gradial/aci-cli-darwin-x64": "0.1.40",
+    "@gradial/aci-cli-linux-arm64": "0.1.40",
+    "@gradial/aci-cli-linux-x64": "0.1.40",
+    "@gradial/aci-cli-win32-arm64": "0.1.40",
+    "@gradial/aci-cli-win32-x64": "0.1.40"
   }
-}
+}

package/src/astro/ConsentBanner.astro

@@ -0,0 +1,62 @@
+---
+// ConsentBanner.astro — Astro wrapper around the SDK's first-party consent
+// banner. Import this into your layout and pass site-specific text/styles.
+//
+// Usage:
+//   import ConsentBanner from '@gradial/aci/astro/ConsentBanner.astro';
+//   <ConsentBanner
+//     heading="Cookie Preferences"
+//     message="We use cookies to personalize your experience."
+//     acceptLabel="Accept all"
+//     rejectLabel="Reject"
+//     privacyPolicyHref="/privacy"
+//     privacyPolicyLabel="Privacy Policy"
+//   />
+
+export interface Props {
+  heading?: string;
+  message?: string;
+  acceptLabel?: string;
+  rejectLabel?: string;
+  privacyPolicyLabel?: string;
+  privacyPolicyHref?: string;
+  source?: string;
+}
+
+const {
+  heading,
+  message,
+  acceptLabel,
+  rejectLabel,
+  privacyPolicyLabel,
+  privacyPolicyHref,
+  source,
+} = Astro.props as Props;
+
+const opts = JSON.stringify({
+  heading,
+  message,
+  acceptLabel,
+  rejectLabel,
+  privacyPolicyLabel,
+  privacyPolicyHref,
+  source,
+});
+---
+
+<div
+  id="aci-consent-banner-mount"
+  data-aci-consent-banner-mount
+  data-opts={opts}
+>
+</div>
+
+<script>
+  import { mountConsentBanner } from '../consent-banner/index.js';
+
+  const mount = document.getElementById('aci-consent-banner-mount');
+  if (mount) {
+    const opts = JSON.parse(mount.getAttribute('data-opts') || '{}');
+    mountConsentBanner(document, opts);
+  }
+</script>