@gradial/aci 0.1.41 → 0.1.42

package/dist/collect/assignments.d.ts

@@ -0,0 +1,65 @@
+import type { PendingEvent } from "./batcher.js";
+import type { DebugFn } from "./config.js";
+export declare const EXPERIMENT_EXPOSURE_EVENT = "experiment.exposure";
+/** One active assignment read from the page's data-aci-assignments tag. */
+export interface ExperimentAssignment {
+    experimentId: string;
+    armId: string;
+    allocationVersion: string;
+}
+interface DocumentLike {
+    querySelector(selectors: string): {
+        textContent: string | null;
+    } | null;
+}
+/**
+ * readAssignments parses the page's data-aci-assignments tag. Absence, a
+ * malformed body, or an unknown version are tolerated as "no assignments"
+ * (debug record, no throw).
+ */
+export declare function readAssignments(doc: DocumentLike, debug?: DebugFn): ExperimentAssignment[];
+export interface AssignmentsEnv {
+    document: DocumentLike;
+    /** Only location.href is read (the exposure event's url). */
+    window: {
+        location: {
+            href: string;
+        };
+    };
+    debug?: DebugFn;
+}
+export interface AssignmentsHandle {
+    /** The assignments active for the current page view (copies). */
+    getActiveAssignments(): ExperimentAssignment[];
+    /**
+     * start reads the assignments tag and emits `experiment.exposure` once per
+     * (experiment, page view) through `emit`. Called once by init AFTER the
+     * emit pipeline is fully constructed — the handle is created first so
+     * emit's withAssignmentContext dependency exists before emit can run.
+     */
+    start(emit: (event: PendingEvent) => void): void;
+    /**
+     * rearm resets the per-page-view exposure dedupe and re-reads the tag.
+     * Wired by init into the shared navigation hook, ORDERED BEFORE the SPA
+     * page-view emitter so rum.page_view is stamped with the new page's
+     * context (REQ-2/3; see the module-header stale-tag limitation).
+     */
+    rearm(): void;
+}
+/**
+ * withAssignmentContext stamps the first active assignment's experiment
+ * context onto an event that does not already carry one (REQ-3). Events with
+ * explicit context (exposures, explicit conversions) are never overwritten.
+ */
+export declare function withAssignmentContext(event: PendingEvent, handle: AssignmentsHandle | undefined): PendingEvent;
+/**
+ * createAssignments builds the assignments collector without emitting
+ * anything: creation and exposure emission are split so init can construct
+ * the emit pipeline against the handle before any event flows (no circular
+ * "emit captures a not-yet-assigned handle" wiring). start() reads the tag
+ * and emits exposures; rearm() is the SPA-navigation reset, fanned out from
+ * the single navigation hook installed by init — so an "exposure per page
+ * view" matches a "page view" exactly.
+ */
+export declare function createAssignments(env: AssignmentsEnv): AssignmentsHandle;
+export {};

package/dist/collect/assignments.js

@@ -0,0 +1,138 @@
+// Experiment assignments (personalization-reporting design/04/05): the
+// starters render the page's build-time assignment context as a
+// `<script type="application/json" data-aci-assignments>` JSON tag
+// ({"v":1,"experiments":[{experimentId,armId,allocationVersion}]}). This
+// collector parses it, emits `experiment.exposure` at most once per
+// (experiment, page view) (REQ-2), and exposes the active assignments so the
+// emit path can stamp experiment context on every event while an assignment
+// is active (REQ-3). Absent or malformed tags are a silent no-op with a
+// debug record; the page is never affected.
+//
+// KNOWN LIMITATION — SPA client-side routing reads a stale tag. The re-arm
+// (AssignmentsHandle.rearm, wired to the shared navigation hook in init)
+// runs synchronously when pushState/replaceState returns, but client
+// routers (e.g. the Next app router) swap the page's DOM — including the
+// assignments tag — AFTER pushState returns. The re-arm therefore reads the
+// PREVIOUS page's tag. The design assumption is MPA / full-SSR-first
+// navigation, where every page view is a fresh document load and the tag is
+// always current; under pure client-side transitions, exposures and context
+// stamping for the newly routed page lag one navigation behind. Accepted
+// for now — do not "fix" with a MutationObserver.
+export const EXPERIMENT_EXPOSURE_EVENT = "experiment.exposure";
+const ASSIGNMENTS_SELECTOR = 'script[type="application/json"][data-aci-assignments]';
+const ASSIGNMENTS_VERSION = 1;
+function parseAssignment(value) {
+    if (typeof value !== "object" || value === null)
+        return null;
+    const record = value;
+    const experimentId = record.experimentId;
+    const armId = record.armId;
+    const allocationVersion = record.allocationVersion;
+    if (typeof experimentId !== "string" ||
+        experimentId === "" ||
+        typeof armId !== "string" ||
+        armId === "" ||
+        typeof allocationVersion !== "string") {
+        return null;
+    }
+    return { experimentId, armId, allocationVersion };
+}
+/**
+ * readAssignments parses the page's data-aci-assignments tag. Absence, a
+ * malformed body, or an unknown version are tolerated as "no assignments"
+ * (debug record, no throw).
+ */
+export function readAssignments(doc, debug) {
+    try {
+        const tag = doc.querySelector(ASSIGNMENTS_SELECTOR);
+        if (!tag)
+            return [];
+        const raw = tag.textContent;
+        if (raw == null || raw.trim() === "")
+            return [];
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== "object" || parsed === null) {
+            debug?.("capture", { reason: "assignments_malformed" });
+            return [];
+        }
+        const body = parsed;
+        if (body.v !== ASSIGNMENTS_VERSION || !Array.isArray(body.experiments)) {
+            debug?.("capture", { reason: "assignments_malformed" });
+            return [];
+        }
+        const assignments = [];
+        for (const entry of body.experiments) {
+            const assignment = parseAssignment(entry);
+            if (assignment)
+                assignments.push(assignment);
+        }
+        return assignments;
+    }
+    catch (err) {
+        debug?.("capture", {
+            reason: "assignments_parse_failed",
+            error: String(err),
+        });
+        return [];
+    }
+}
+/**
+ * withAssignmentContext stamps the first active assignment's experiment
+ * context onto an event that does not already carry one (REQ-3). Events with
+ * explicit context (exposures, explicit conversions) are never overwritten.
+ */
+export function withAssignmentContext(event, handle) {
+    if (!handle || event.experiment !== undefined)
+        return event;
+    const first = handle.getActiveAssignments()[0];
+    if (!first)
+        return event;
+    const experiment = {
+        experimentId: first.experimentId,
+        armId: first.armId,
+        allocationVersion: first.allocationVersion,
+    };
+    return { ...event, experiment };
+}
+/**
+ * createAssignments builds the assignments collector without emitting
+ * anything: creation and exposure emission are split so init can construct
+ * the emit pipeline against the handle before any event flows (no circular
+ * "emit captures a not-yet-assigned handle" wiring). start() reads the tag
+ * and emits exposures; rearm() is the SPA-navigation reset, fanned out from
+ * the single navigation hook installed by init — so an "exposure per page
+ * view" matches a "page view" exactly.
+ */
+export function createAssignments(env) {
+    let active = [];
+    const exposed = new Set();
+    let emit;
+    const arm = () => {
+        active = readAssignments(env.document, env.debug);
+        for (const assignment of active) {
+            if (exposed.has(assignment.experimentId))
+                continue;
+            exposed.add(assignment.experimentId);
+            emit?.({
+                eventName: EXPERIMENT_EXPOSURE_EVENT,
+                url: env.window.location.href,
+                experiment: {
+                    experimentId: assignment.experimentId,
+                    armId: assignment.armId,
+                    allocationVersion: assignment.allocationVersion,
+                },
+            });
+        }
+    };
+    return {
+        getActiveAssignments: () => active.map((assignment) => ({ ...assignment })),
+        start(emitFn) {
+            emit = emitFn;
+            arm();
+        },
+        rearm() {
+            exposed.clear();
+            arm();
+        },
+    };
+}

package/dist/collect/batcher.d.ts

@@ -1,4 +1,16 @@
 import type { DebugFn } from "./config.js";
+/**
+ * Structured experiment context (personalization-reporting REQ-1/REQ-3):
+ * populated from the page's data-aci-assignments tag so conversions are
+ * attributable to (experiment, arm) at ingest. Explicit conversions may add
+ * goalId.
+ */
+export interface ExperimentContext {
+    experimentId: string;
+    armId: string;
+    allocationVersion: string;
+    goalId?: string;
+}
 /** One collect event on the wire (personalization-data-plane design/04). */
 export interface CollectEvent {
     eventId: string;
@@ -7,11 +19,20 @@ export interface CollectEvent {
     properties?: Record<string, unknown>;
     url?: string;
     referrer?: string;
+    experiment?: ExperimentContext;
 }
 /** An event at capture time, before the eventId is stamped. */
 export type PendingEvent = Omit<CollectEvent, "eventId">;
 /** Planning threshold: full serialized envelope, UTF-8 bytes. */
 export declare const MAX_BATCH_BYTES: number;
+/**
+ * Hard event-count cap per envelope. The Next collect-route imports this
+ * constant and rejects larger envelopes (the Go handler enforces only the
+ * 64KiB body cap today), so a byte-capped-only batch of small events (~400
+ * fit in 60KiB) would 400 on that host and silently lose the whole flush.
+ * The client caps at the strictest host.
+ */
+export declare const MAX_BATCH_EVENTS = 100;
 /** Flush interval (build-time constant, design/04 config table). */
 export declare const FLUSH_INTERVAL_MS = 5000;
 export interface BatcherTimers {

package/dist/collect/batcher.js

@@ -4,6 +4,14 @@
 // per-event size computed at enqueue — so a flush stays O(n).
 /** Planning threshold: full serialized envelope, UTF-8 bytes. */
 export const MAX_BATCH_BYTES = 60 * 1024;
+/**
+ * Hard event-count cap per envelope. The Next collect-route imports this
+ * constant and rejects larger envelopes (the Go handler enforces only the
+ * 64KiB body cap today), so a byte-capped-only batch of small events (~400
+ * fit in 60KiB) would 400 on that host and silently lose the whole flush.
+ * The client caps at the strictest host.
+ */
+export const MAX_BATCH_EVENTS = 100;
 /** Flush interval (build-time constant, design/04 config table). */
 export const FLUSH_INTERVAL_MS = 5000;
 const ENVELOPE_PREFIX = '{"events":[';
@@ -111,6 +119,8 @@ export class Batcher {
                 const next = this.queue[0];
                 if (ENVELOPE_OVERHEAD + next.bytes > this.maxBytes)
                     break; // oversize: outer loop drops it
+                if (parts.length >= MAX_BATCH_EVENTS)
+                    break; // host-side envelope cap
                 const nextSize = size + next.bytes + (parts.length > 0 ? 1 : 0);
                 if (nextSize > this.maxBytes)
                     break;

package/dist/collect/declarative.d.ts

@@ -31,5 +31,5 @@ export declare function toCustomEventName(raw: unknown): string | undefined;
  * environment has an IntersectionObserver, observes every visible-declared
  * element present at start.
  */
-export declare function startDeclarative(emit: (event: PendingEvent) => void, env: DeclarativeEnv): void;
+export declare function startDeclarative(emit: (event: PendingEvent) => void, env: DeclarativeEnv, refresh?: () => void): void;
 export {};

package/dist/collect/declarative.js

@@ -6,6 +6,7 @@
 const EVENT_ATTR = "data-aci-event";
 const ON_ATTR = "data-aci-on";
 const PROP_ATTR_PREFIX = "data-aci-prop-";
+const REFRESH_ATTR = "data-aci-refresh";
 const CUSTOM_PREFIX = "custom.";
 const VISIBLE_THRESHOLD = 0.5;
 /**
@@ -50,11 +51,16 @@ function trigger(el) {
  * environment has an IntersectionObserver, observes every visible-declared
  * element present at start.
  */
-export function startDeclarative(emit, env) {
+export function startDeclarative(emit, env, refresh) {
     const { document: doc, debug } = env;
     doc.addEventListener("click", (e) => {
         try {
             const target = e.target;
+            const refreshTarget = target?.closest?.(`[${REFRESH_ATTR}]`);
+            if (refreshTarget) {
+                refresh?.();
+                return;
+            }
             const el = target?.closest?.(`[${EVENT_ATTR}]`);
             if (!el)
                 return;

package/dist/collect/index.js

@@ -3,6 +3,7 @@
 // init(); every failure is swallowed after a debug record so the page is
 // never affected (QR-2/3).
 import { installCommandQueue } from "./api.js";
+import { createAssignments, withAssignmentContext } from "./assignments.js";
 import { Batcher } from "./batcher.js";
 import { createDebug, readTagConfig } from "./config.js";
 import { start as startC15t } from "./consent/adapters/c15t.js";
@@ -13,8 +14,8 @@ import { applyConsent, envelopeGrantsPersonalization, readConsentCookie, sanitiz
 import { startDeclarative } from "./declarative.js";
 import { GapBuffer, hasMintMarker, maybeFlushGapBuffer, routeEvent, } from "./gapbuffer.js";
 import { startLinkClicks } from "./linkclicks.js";
-import { startPageViews } from "./pageviews.js";
-import { send } from "./transport.js";
+import { installNavigationHook, startPageViews, } from "./pageviews.js";
+import { refreshClaims, send } from "./transport.js";
 import { ulid } from "./ulid.js";
 import { startVariationViews } from "./variationviews.js";
 import { startWebVitals } from "./webvitals.js";
@@ -94,12 +95,24 @@ export function init(win) {
             documentTarget: doc,
             windowTarget: w,
         });
+        // While an assignment is active, every emitted event carries the first
+        // active assignment's experiment context (REQ-3) unless it already has
+        // one — exposures and explicit conversions carry their own. The handle
+        // is created (without emitting) BEFORE emit so every dependency of emit
+        // exists before emit can run; exposures flow at start() below.
+        const assignments = createAssignments({ document: doc, window: w, debug });
         const emit = (event) => {
             routeEvent({
-                ...event,
+                ...withAssignmentContext(event, assignments),
                 eventId: ulid(undefined, (bytes) => w.crypto.getRandomValues(bytes)),
             }, { grants, marker, gapBuffer, batcher });
         };
+        // Started BEFORE the command-queue drain and page views: pre-load
+        // aci('track', ...) calls and the initial rum.page_view must be stamped
+        // with the active assignment context, or queued conversions can never
+        // match a goal (review-quorum finding). Consent commands drained after
+        // this stay safe — events wait in the gap buffer until grants resolve.
+        assignments.start(emit);
         installCommandQueue(w, cfg, {
             track: (name, properties) => emit({ eventName: name, properties }),
             consent: ({ p, src }) => {
@@ -111,11 +124,24 @@ export function init(win) {
                 applyConsent(purposes, typeof src === "string" && src.trim() !== "" ? src.trim() : "manual", { document: doc, gapBuffer });
             },
         }, debug);
-        startPageViews(emit, w);
+        const emitPageView = startPageViews(emit, w);
+        // The single history patch (one pushState/replaceState wrap, one dedupe
+        // state, one popstate listener). Order is load-bearing: the assignments
+        // re-arm runs BEFORE the SPA page view so rum.page_view is stamped with
+        // the new page's experiment context.
+        installNavigationHook(w, [
+            () => assignments.rearm(),
+            emitPageView,
+        ]);
         startDeclarative(emit, {
             document: doc,
             intersectionObserver: w.IntersectionObserver,
             debug,
+        }, () => {
+            void refreshClaims(transportEnv).then((refreshed) => {
+                if (refreshed)
+                    w.location.reload();
+            });
         });
         startLinkClicks(emit, { document: doc, debug });
         startWebVitals(emit, {

package/dist/collect/pageviews.d.ts

@@ -15,8 +15,20 @@ export interface PageViewWindow {
     addEventListener(type: string, fn: () => void): void;
 }
 /**
- * startPageViews emits the initial page view and hooks
- * pushState/replaceState/popstate for SPA route changes.
+ * installNavigationHook wires pushState/replaceState/popstate and invokes
+ * the subscribers, in order, once per SPA route change; hash-only changes
+ * and same-URL repeats never fire. Installed exactly ONCE by init — one
+ * history patch, one dedupe state — and shared by the assignments collector
+ * and page views so "page view" means exactly the same thing to both
+ * (REQ-2). Subscriber order is the contract: init lists the assignments
+ * re-arm BEFORE the page-view emitter so rum.page_view is stamped with the
+ * new page's experiment context.
  */
-export declare function startPageViews(emit: (event: PendingEvent) => void, win: PageViewWindow): void;
+export declare function installNavigationHook(win: PageViewWindow, subscribers: ReadonlyArray<() => void>): void;
+/**
+ * startPageViews emits the initial page view and returns the emitter for
+ * SPA route-change views — init subscribes it to the single navigation hook
+ * (after the assignments re-arm; see installNavigationHook).
+ */
+export declare function startPageViews(emit: (event: PendingEvent) => void, win: PageViewWindow): () => void;
 export {};

package/dist/collect/pageviews.js

@@ -9,34 +9,49 @@ function stripHash(href) {
     return i === -1 ? href : href.slice(0, i);
 }
 /**
- * startPageViews emits the initial page view and hooks
- * pushState/replaceState/popstate for SPA route changes.
+ * installNavigationHook wires pushState/replaceState/popstate and invokes
+ * the subscribers, in order, once per SPA route change; hash-only changes
+ * and same-URL repeats never fire. Installed exactly ONCE by init — one
+ * history patch, one dedupe state — and shared by the assignments collector
+ * and page views so "page view" means exactly the same thing to both
+ * (REQ-2). Subscriber order is the contract: init lists the assignments
+ * re-arm BEFORE the page-view emitter so rum.page_view is stamped with the
+ * new page's experiment context.
  */
-export function startPageViews(emit, win) {
-    const view = () => emit({
-        eventName: PAGE_VIEW_EVENT,
-        url: win.location.href,
-        referrer: win.document.referrer,
-    });
+export function installNavigationHook(win, subscribers) {
     let last = stripHash(win.location.href);
-    view();
-    const onNavigate = () => {
+    const handler = () => {
         const current = stripHash(win.location.href);
         if (current === last)
             return; // hash-only change or same-URL repeat
         last = current;
-        view();
+        for (const onNavigate of subscribers)
+            onNavigate();
     };
     const history = win.history;
     const wrap = (method) => {
         const original = history[method].bind(history);
         history[method] = (...args) => {
             const result = original(...args);
-            onNavigate();
+            handler();
             return result;
         };
     };
     wrap("pushState");
     wrap("replaceState");
-    win.addEventListener("popstate", onNavigate);
+    win.addEventListener("popstate", handler);
+}
+/**
+ * startPageViews emits the initial page view and returns the emitter for
+ * SPA route-change views — init subscribes it to the single navigation hook
+ * (after the assignments re-arm; see installNavigationHook).
+ */
+export function startPageViews(emit, win) {
+    const view = () => emit({
+        eventName: PAGE_VIEW_EVENT,
+        url: win.location.href,
+        referrer: win.document.referrer,
+    });
+    view();
+    return view;
 }

package/dist/collect/transport.d.ts

@@ -7,6 +7,7 @@ export type FetchLike = (input: string, init?: {
     method?: string;
     body?: Blob;
     keepalive?: boolean;
+    credentials?: "same-origin";
 }) => Promise<unknown>;
 export interface TransportEnv {
     /** Present key (even if undefined) overrides the global for tests. */
@@ -20,3 +21,4 @@ export interface TransportEnv {
  * never affected.
  */
 export declare function send(body: string, env?: TransportEnv): void;
+export declare function refreshClaims(env?: TransportEnv): Promise<boolean>;

package/dist/collect/transport.js

@@ -50,3 +50,35 @@ export function send(body, env) {
         debug?.("flush", { reason: "fetch_failed", error: String(err) });
     }
 }
+// refreshClaims deliberately uses fetch rather than sendBeacon. The host's
+// response may refresh the visitor's audience state, so this explicit action
+// must make a normal same-origin request with an empty event envelope.
+export function refreshClaims(env) {
+    const fetchFn = env !== undefined && "fetch" in env
+        ? env.fetch
+        : globalThis.fetch;
+    if (!fetchFn)
+        return Promise.resolve(false);
+    try {
+        const body = new Blob(['{"events":[]}'], { type: "text/plain" });
+        return fetchFn(COLLECT_PATH, {
+            method: "POST",
+            body,
+            keepalive: true,
+            credentials: "same-origin",
+        }).then((response) => {
+            if (typeof response === "object" && response !== null && "ok" in response && response.ok === false) {
+                env?.debug?.("flush", { reason: "refresh_failed", status: "not_ok" });
+                return false;
+            }
+            return true;
+        }).catch((err) => {
+            env?.debug?.("flush", { reason: "refresh_failed", error: String(err) });
+            return false;
+        });
+    }
+    catch (err) {
+        env?.debug?.("flush", { reason: "refresh_failed", error: String(err) });
+        return Promise.resolve(false);
+    }
+}

package/dist/consent-banner/index.d.ts

@@ -0,0 +1,33 @@
+export interface ConsentBannerOptions {
+    /** Heading text. Default: "Privacy" */
+    heading?: string;
+    /** Body text explaining what the user is consenting to. */
+    message?: string;
+    /** Label for the accept button. Default: "Accept" */
+    acceptLabel?: string;
+    /** Label for the reject button. Default: "Reject" */
+    rejectLabel?: string;
+    /** Label for a link to the privacy policy. Optional. */
+    privacyPolicyLabel?: string;
+    /** URL to the privacy policy. Optional. */
+    privacyPolicyHref?: string;
+    /** Source identifier written to the cookie envelope. Default: "banner" */
+    source?: string;
+    /** Callback fired after a consent decision is written. */
+    onDecision?: (granted: boolean) => void;
+}
+/**
+ * hasConsentCookie returns true when the aci_consent cookie exists (the user
+ * has already made a decision, regardless of whether they granted or denied).
+ */
+export declare function hasConsentCookie(doc: {
+    cookie: string;
+}): boolean;
+/**
+ * mountConsentBanner checks for an existing consent cookie. If none exists,
+ * it injects a banner into the document body and wires up accept/reject
+ * buttons. If a cookie already exists, it does nothing (idempotent).
+ *
+ * Returns a cleanup function that removes the banner and event listeners.
+ */
+export declare function mountConsentBanner(doc: Document, opts?: ConsentBannerOptions): () => void;

package/dist/consent-banner/index.js

@@ -0,0 +1,99 @@
+// First-party consent banner (design/04, preset="manual"): a self-contained
+// client-side component for sites that don't have an external CMP (c15t,
+// OneTrust, etc.). Checks for the aci_consent cookie, shows a banner if
+// absent, and calls applyConsent() on user decision.
+//
+// The banner is framework-agnostic — it renders plain DOM and is driven by
+// CSS classes so each site can style it. The Astro wrapper component
+// (packages/sdk/src/astro/ConsentBanner.astro) imports and invokes this,
+// then applies site-specific styles.
+import { applyConsent, readConsentCookie, PERSONALIZATION_PURPOSE, } from "../collect/consent/envelope.js";
+const DEFAULTS = {
+    heading: "Privacy",
+    message: "We use cookies to personalize content and improve your experience. You can accept or reject personalization.",
+    acceptLabel: "Accept",
+    rejectLabel: "Reject",
+    source: "banner",
+};
+const BANNER_ID = "aci-consent-banner";
+const BANNER_ATTR = "data-aci-consent-banner";
+const BANNER_HIDDEN = "aci-consent-banner--hidden";
+/**
+ * hasConsentCookie returns true when the aci_consent cookie exists (the user
+ * has already made a decision, regardless of whether they granted or denied).
+ */
+export function hasConsentCookie(doc) {
+    return readConsentCookie(doc) !== undefined;
+}
+/**
+ * mountConsentBanner checks for an existing consent cookie. If none exists,
+ * it injects a banner into the document body and wires up accept/reject
+ * buttons. If a cookie already exists, it does nothing (idempotent).
+ *
+ * Returns a cleanup function that removes the banner and event listeners.
+ */
+export function mountConsentBanner(doc, opts = {}) {
+    if (hasConsentCookie(doc))
+        return () => { };
+    if (doc.getElementById(BANNER_ID))
+        return () => { };
+    const config = { ...DEFAULTS, ...opts };
+    const banner = createBannerElement(config, doc);
+    doc.body.appendChild(banner);
+    const cleanup = () => {
+        banner.remove();
+    };
+    const decide = (granted) => {
+        const purposes = granted ? [PERSONALIZATION_PURPOSE] : [];
+        applyConsent(purposes, config.source, { document: doc });
+        banner.classList.add(BANNER_HIDDEN);
+        setTimeout(cleanup, 300);
+        opts.onDecision?.(granted);
+    };
+    banner.querySelector("[data-aci-consent-accept]")?.addEventListener("click", () => decide(true));
+    banner.querySelector("[data-aci-consent-reject]")?.addEventListener("click", () => decide(false));
+    return cleanup;
+}
+function createBannerElement(config, doc) {
+    const banner = doc.createElement("div");
+    banner.id = BANNER_ID;
+    banner.setAttribute(BANNER_ATTR, "");
+    banner.className = BANNER_ID;
+    const content = doc.createElement("div");
+    content.className = `${BANNER_ID}__content`;
+    const text = doc.createElement("div");
+    text.className = `${BANNER_ID}__text`;
+    const heading = doc.createElement("p");
+    heading.className = `${BANNER_ID}__heading`;
+    heading.textContent = config.heading;
+    text.appendChild(heading);
+    const message = doc.createElement("p");
+    message.className = `${BANNER_ID}__message`;
+    message.textContent = config.message;
+    text.appendChild(message);
+    if (config.privacyPolicyHref && config.privacyPolicyLabel) {
+        const link = doc.createElement("a");
+        link.className = `${BANNER_ID}__privacy-link`;
+        link.href = config.privacyPolicyHref;
+        link.textContent = config.privacyPolicyLabel;
+        text.appendChild(link);
+    }
+    content.appendChild(text);
+    const actions = doc.createElement("div");
+    actions.className = `${BANNER_ID}__actions`;
+    const rejectBtn = doc.createElement("button");
+    rejectBtn.type = "button";
+    rejectBtn.className = `${BANNER_ID}__btn ${BANNER_ID}__btn--reject`;
+    rejectBtn.setAttribute("data-aci-consent-reject", "");
+    rejectBtn.textContent = config.rejectLabel;
+    actions.appendChild(rejectBtn);
+    const acceptBtn = doc.createElement("button");
+    acceptBtn.type = "button";
+    acceptBtn.className = `${BANNER_ID}__btn ${BANNER_ID}__btn--accept`;
+    acceptBtn.setAttribute("data-aci-consent-accept", "");
+    acceptBtn.textContent = config.acceptLabel;
+    actions.appendChild(acceptBtn);
+    content.appendChild(actions);
+    banner.appendChild(content);
+    return banner;
+}