@kywi-software/core 0.14.0 → 0.15.0

package/dist/audiences/collectors/identity.js

@@ -1,7 +1,20 @@
 import { COOKIE_NAMES } from '../cookies.js';
-export function collectIdentity(cookies) {
-    const visitorId = cookies.get(COOKIE_NAMES.VISITOR) ?? '';
-    const knownRaw = cookies.get(COOKIE_NAMES.KNOWN);
+import { cookieAllowed, readConsentFromCookieHeader } from '../consent.js';
+/**
+ * Read the visitor's stored identity — the `kywi_visitor` id and the
+ * adapter-pushed `kywi_known` flag.
+ *
+ * Both are `personalization` cookies, so both are treated as ABSENT unless the
+ * visitor consents (kywi-cms#91): a visitor who rejects must stop being
+ * recognised, not merely stop accumulating new cookies. An empty `visitorId` is
+ * already the "no identity yet" value every caller handles — the request still
+ * resolves and renders, anonymously.
+ */
+export function collectIdentity(cookies, gate = {}) {
+    const consent = readConsentFromCookieHeader(gate.cookieHeader);
+    const mayRead = (name) => cookieAllowed(name, consent, gate);
+    const visitorId = (mayRead(COOKIE_NAMES.VISITOR) ? cookies.get(COOKIE_NAMES.VISITOR) : undefined) ?? '';
+    const knownRaw = mayRead(COOKIE_NAMES.KNOWN) ? cookies.get(COOKIE_NAMES.KNOWN) : undefined;
     let isKnown = false;
     let maLeadId = null;
     if (knownRaw) {

package/dist/audiences/collectors/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/audiences/collectors/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAQ5C,MAAM,UAAU,eAAe,CAAC,OAA4B;IAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;IACzD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;IAChD,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,IAAI,QAAQ,GAAkB,IAAI,CAAA;IAClC,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA0B,CAAA;YAC1D,OAAO,GAAG,IAAI,CAAA;YACd,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAA;QAClC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;AACzC,CAAC"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/audiences/collectors/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,2BAA2B,EAA2B,MAAM,eAAe,CAAA;AAQnG;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,OAA4B,EAC5B,OAA8D,EAAE;IAEhE,MAAM,OAAO,GAAG,2BAA2B,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAC9D,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;IACpE,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;IACvG,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1F,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,IAAI,QAAQ,GAAkB,IAAI,CAAA;IAClC,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA0B,CAAA;YAC1D,OAAO,GAAG,IAAI,CAAA;YACd,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAA;QAClC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;AACzC,CAAC"}

package/dist/audiences/collectors/index.d.ts

@@ -2,7 +2,17 @@ export { collectUtm, type UtmSignals } from './utm.js';
 export { collectReferrer, classifyReferrer, type ReferrerSignals, type ReferrerSourceType } from './referrer.js';
 export { collectIdentity, type IdentitySignals } from './identity.js';
 export { collectOptOut } from './opt-out.js';
-export { collectPinnedAudience } from './pinned-audience.js';
+export { collectPinnedAudience, parseAudiencePin, buildAudiencePinValue, type AudiencePin, } from './pinned-audience.js';
 import type { VisitorSignals } from '../types.js';
-export declare function runServerCollectors(req: Request): Partial<VisitorSignals>;
+import type { ConsentGateOptions } from '../consent.js';
+/**
+ * Collect every server-resolvable signal off the request.
+ *
+ * The personalization-category cookies (`kywi_utm`, `kywi_visitor`,
+ * `kywi_known`) are read only for a consenting visitor — pass `requireConsent:
+ * false` to turn that off for a site whose consent lives in external tooling
+ * (kywi-cms#91). Un-stored signals (this URL's `utm_*` params, the referrer) are
+ * always collected: they are the request itself, not tracking carried into it.
+ */
+export declare function runServerCollectors(req: Request, gate?: ConsentGateOptions): Partial<VisitorSignals>;
 //# sourceMappingURL=index.d.ts.map

package/dist/audiences/collectors/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/audiences/collectors/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAE,MAAM,UAAU,CAAA;AACtD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,KAAK,eAAe,EAAE,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAChH,OAAO,EAAE,eAAe,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAA;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAE5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAOjD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CAYzE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/audiences/collectors/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAE,MAAM,UAAU,CAAA;AACtD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,KAAK,eAAe,EAAE,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAChH,OAAO,EAAE,eAAe,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAA;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,WAAW,GACjB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAMjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAEvD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,OAAO,EACZ,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,cAAc,CAAC,CAczB"}

package/dist/audiences/collectors/index.js

@@ -2,17 +2,28 @@ export { collectUtm } from './utm.js';
 export { collectReferrer, classifyReferrer } from './referrer.js';
 export { collectIdentity } from './identity.js';
 export { collectOptOut } from './opt-out.js';
-export { collectPinnedAudience } from './pinned-audience.js';
+export { collectPinnedAudience, parseAudiencePin, buildAudiencePinValue, } from './pinned-audience.js';
 import { parseCookies } from '../cookies.js';
 import { collectUtm } from './utm.js';
 import { collectReferrer } from './referrer.js';
 import { collectIdentity } from './identity.js';
 import { collectOptOut } from './opt-out.js';
-export function runServerCollectors(req) {
-    const cookies = parseCookies(req.headers.get('cookie') ?? '');
-    const utm = collectUtm(req, cookies);
+/**
+ * Collect every server-resolvable signal off the request.
+ *
+ * The personalization-category cookies (`kywi_utm`, `kywi_visitor`,
+ * `kywi_known`) are read only for a consenting visitor — pass `requireConsent:
+ * false` to turn that off for a site whose consent lives in external tooling
+ * (kywi-cms#91). Un-stored signals (this URL's `utm_*` params, the referrer) are
+ * always collected: they are the request itself, not tracking carried into it.
+ */
+export function runServerCollectors(req, gate = {}) {
+    const cookieHeader = req.headers.get('cookie');
+    const cookies = parseCookies(cookieHeader ?? '');
+    const readGate = { ...gate, cookieHeader };
+    const utm = collectUtm(req, cookies, readGate);
     const referrer = collectReferrer(req, utm.medium);
-    const identity = collectIdentity(cookies);
+    const identity = collectIdentity(cookies, readGate);
     const isOptedOut = collectOptOut(cookies);
     return {
         utm,

package/dist/audiences/collectors/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/audiences/collectors/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAmB,MAAM,UAAU,CAAA;AACtD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAiD,MAAM,eAAe,CAAA;AAChH,OAAO,EAAE,eAAe,EAAwB,MAAM,eAAe,CAAA;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAG5D,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAE5C,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;IAC7D,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IACpC,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACjD,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IACzC,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;IACzC,OAAO;QACL,GAAG;QACH,QAAQ;QACR,QAAQ;QACR,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE;KACtF,CAAA;AACH,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/audiences/collectors/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAmB,MAAM,UAAU,CAAA;AACtD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAiD,MAAM,eAAe,CAAA;AAChH,OAAO,EAAE,eAAe,EAAwB,MAAM,eAAe,CAAA;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,qBAAqB,GAEtB,MAAM,sBAAsB,CAAA;AAG7B,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAG5C;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAY,EACZ,OAA2B,EAAE;IAE7B,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC9C,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,IAAI,EAAE,CAAC,CAAA;IAChD,MAAM,QAAQ,GAAG,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,CAAA;IAC1C,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;IAC9C,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACjD,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IACnD,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;IACzC,OAAO;QACL,GAAG;QACH,QAAQ;QACR,QAAQ;QACR,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE;KACtF,CAAA;AACH,CAAC"}

package/dist/audiences/collectors/pinned-audience.d.ts

@@ -1,4 +1,27 @@
+import { type ConsentGateOptions } from '../consent.js';
 import type { Audience } from '../types.js';
+/**
+ * The `kywi_audience` cookie's value, which records HOW the pin was made.
+ *
+ * Two writes share this cookie and they carry different consent weight
+ * (kywi-cms#91): the runtime automatically remembering what it resolved is
+ * `personalization` tracking, while an audience the visitor picked by hand in
+ * the transparency panel is an `essential` preference. The cookie has to say
+ * which, or the read side cannot apply the right rule and a hand-picked audience
+ * would be stored and then silently ignored.
+ */
+export interface AudiencePin {
+    id: string;
+    /** The visitor chose this deliberately, so it is an `essential` preference. */
+    viaSwitcher: boolean;
+}
+/** Encode a pin for the `kywi_audience` cookie. */
+export declare function buildAudiencePinValue(id: string, viaSwitcher: boolean): string;
+/**
+ * Decode a `kywi_audience` cookie value. A bare id — every cookie written before
+ * kywi-cms#91, and every boot pin since — reads as a non-switcher pin.
+ */
+export declare function parseAudiencePin(raw: string | undefined | null): AudiencePin | null;
 /**
  * Read the client-pinned audience (`kywi_audience` cookie).
  *
@@ -11,7 +34,10 @@ import type { Audience } from '../types.js';
  * and deletes it), so the id is untrusted input: it is only honoured when it
  * names a *currently-active* audience for this render. A stale, forged, or
  * archived id is treated as absent — the caller falls through to signal-derived
- * resolution and the render never errors.
+ * resolution and the render never errors. So is a pin the visitor has not
+ * consented to being remembered by.
  */
-export declare function collectPinnedAudience(cookies: Map<string, string>, activeAudiences: Audience[]): string | null;
+export declare function collectPinnedAudience(cookies: Map<string, string>, activeAudiences: Audience[], gate?: ConsentGateOptions & {
+    cookieHeader?: string | null;
+}): string | null;
 //# sourceMappingURL=pinned-audience.d.ts.map

package/dist/audiences/collectors/pinned-audience.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pinned-audience.d.ts","sourceRoot":"","sources":["../../../src/audiences/collectors/pinned-audience.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAE3C;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,eAAe,EAAE,QAAQ,EAAE,GAC1B,MAAM,GAAG,IAAI,CAIf"}
+{"version":3,"file":"pinned-audience.d.ts","sourceRoot":"","sources":["../../../src/audiences/collectors/pinned-audience.ts"],"names":[],"mappings":"AACA,OAAO,EAA8C,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAA;AACnG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAE3C;;;;;;;;;GASG;AACH,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAA;IACV,+EAA+E;IAC/E,WAAW,EAAE,OAAO,CAAA;CACrB;AAED,mDAAmD;AACnD,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,MAAM,CAK9E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,WAAW,GAAG,IAAI,CAOnF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,eAAe,EAAE,QAAQ,EAAE,EAC3B,IAAI,GAAE,kBAAkB,GAAG;IAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GAC/D,MAAM,GAAG,IAAI,CAYf"}

package/dist/audiences/collectors/pinned-audience.js

@@ -1,4 +1,25 @@
 import { COOKIE_NAMES } from '../cookies.js';
+import { cookieAllowedByHeader, SWITCHER_PIN_PREFIX } from '../consent.js';
+/** Encode a pin for the `kywi_audience` cookie. */
+export function buildAudiencePinValue(id, viaSwitcher) {
+    // A plain id stays a plain id: the un-prefixed form is what every version
+    // before kywi-cms#91 wrote, and keeping it means an existing cookie survives
+    // the upgrade reading exactly as it always did (as a boot pin).
+    return viaSwitcher ? `${SWITCHER_PIN_PREFIX}${id}` : id;
+}
+/**
+ * Decode a `kywi_audience` cookie value. A bare id — every cookie written before
+ * kywi-cms#91, and every boot pin since — reads as a non-switcher pin.
+ */
+export function parseAudiencePin(raw) {
+    if (!raw)
+        return null;
+    if (raw.startsWith(SWITCHER_PIN_PREFIX)) {
+        const id = raw.slice(SWITCHER_PIN_PREFIX.length);
+        return id ? { id, viaSwitcher: true } : null;
+    }
+    return { id: raw, viaSwitcher: false };
+}
 /**
  * Read the client-pinned audience (`kywi_audience` cookie).
  *
@@ -11,12 +32,21 @@ import { COOKIE_NAMES } from '../cookies.js';
  * and deletes it), so the id is untrusted input: it is only honoured when it
  * names a *currently-active* audience for this render. A stale, forged, or
  * archived id is treated as absent — the caller falls through to signal-derived
- * resolution and the render never errors.
+ * resolution and the render never errors. So is a pin the visitor has not
+ * consented to being remembered by.
  */
-export function collectPinnedAudience(cookies, activeAudiences) {
-    const pinned = cookies.get(COOKIE_NAMES.AUDIENCE);
-    if (!pinned)
+export function collectPinnedAudience(cookies, activeAudiences, gate = {}) {
+    const pin = parseAudiencePin(cookies.get(COOKIE_NAMES.AUDIENCE));
+    if (!pin)
+        return null;
+    // An automatic pin is `personalization`: a visitor who rejects stops being
+    // resolved from tracking they no longer consent to. A pin they set by hand is
+    // `essential` and is honoured either way — refusing to act on the switcher
+    // they just used would make the panel lie about what its buttons do
+    // (kywi-cms#91).
+    if (!pin.viaSwitcher && !cookieAllowedByHeader(COOKIE_NAMES.AUDIENCE, gate.cookieHeader, gate)) {
         return null;
-    return activeAudiences.some((a) => a.id === pinned) ? pinned : null;
+    }
+    return activeAudiences.some((a) => a.id === pin.id) ? pin.id : null;
 }
 //# sourceMappingURL=pinned-audience.js.map

package/dist/audiences/collectors/pinned-audience.js.map

@@ -1 +1 @@
-{"version":3,"file":"pinned-audience.js","sourceRoot":"","sources":["../../../src/audiences/collectors/pinned-audience.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAG5C;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAA4B,EAC5B,eAA2B;IAE3B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAA;IACjD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;AACrE,CAAC"}
+{"version":3,"file":"pinned-audience.js","sourceRoot":"","sources":["../../../src/audiences/collectors/pinned-audience.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAA2B,MAAM,eAAe,CAAA;AAmBnG,mDAAmD;AACnD,MAAM,UAAU,qBAAqB,CAAC,EAAU,EAAE,WAAoB;IACpE,0EAA0E;IAC1E,6EAA6E;IAC7E,gEAAgE;IAChE,OAAO,WAAW,CAAC,CAAC,CAAC,GAAG,mBAAmB,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAA8B;IAC7D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,IAAI,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAA;QAChD,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAC9C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,CAAA;AACxC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAA4B,EAC5B,eAA2B,EAC3B,OAA8D,EAAE;IAEhE,MAAM,GAAG,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAA;IAChE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,2EAA2E;IAC3E,8EAA8E;IAC9E,2EAA2E;IAC3E,oEAAoE;IACpE,iBAAiB;IACjB,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC;QAC/F,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AACrE,CAAC"}

package/dist/audiences/collectors/utm.d.ts

@@ -1,3 +1,4 @@
+import { type ConsentGateOptions } from '../consent.js';
 export interface UtmSignals {
     source: string | null;
     medium: string | null;
@@ -5,5 +6,18 @@ export interface UtmSignals {
     term: string | null;
     content: string | null;
 }
-export declare function collectUtm(req: Request, cookies: Map<string, string>): UtmSignals;
+/**
+ * Resolve the visitor's UTM attribution: this request's `utm_*` query params,
+ * falling back to the persisted `kywi_utm` cookie.
+ *
+ * The cookie fallback is IGNORED unless the visitor consents to personalization
+ * (kywi-cms#91). Blocking the write alone would not be enough — a visitor who
+ * accepted last month and rejects today still carries the cookie, and reading it
+ * would keep them in a campaign audience they just opted out of. The URL's own
+ * `utm_*` params are always honoured: they are this request's content, not
+ * stored tracking.
+ */
+export declare function collectUtm(req: Request, cookies: Map<string, string>, gate?: ConsentGateOptions & {
+    cookieHeader?: string | null;
+}): UtmSignals;
 //# sourceMappingURL=utm.d.ts.map

package/dist/audiences/collectors/utm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utm.d.ts","sourceRoot":"","sources":["../../../src/audiences/collectors/utm.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CACvB;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,UAAU,CAcjF"}
+{"version":3,"file":"utm.d.ts","sourceRoot":"","sources":["../../../src/audiences/collectors/utm.ts"],"names":[],"mappings":"AACA,OAAO,EAAyB,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAE9E,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CACvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CACxB,GAAG,EAAE,OAAO,EACZ,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,IAAI,GAAE,kBAAkB,GAAG;IAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GAC/D,UAAU,CAgBZ"}

package/dist/audiences/collectors/utm.js

@@ -1,8 +1,22 @@
 import { COOKIE_NAMES } from '../cookies.js';
-export function collectUtm(req, cookies) {
+import { cookieAllowedByHeader } from '../consent.js';
+/**
+ * Resolve the visitor's UTM attribution: this request's `utm_*` query params,
+ * falling back to the persisted `kywi_utm` cookie.
+ *
+ * The cookie fallback is IGNORED unless the visitor consents to personalization
+ * (kywi-cms#91). Blocking the write alone would not be enough — a visitor who
+ * accepted last month and rejects today still carries the cookie, and reading it
+ * would keep them in a campaign audience they just opted out of. The URL's own
+ * `utm_*` params are always honoured: they are this request's content, not
+ * stored tracking.
+ */
+export function collectUtm(req, cookies, gate = {}) {
     const url = new URL(req.url);
     let cookieUtm = {};
-    const raw = cookies.get(COOKIE_NAMES.UTM);
+    const raw = cookieAllowedByHeader(COOKIE_NAMES.UTM, gate.cookieHeader ?? req.headers.get('cookie'), gate)
+        ? cookies.get(COOKIE_NAMES.UTM)
+        : undefined;
     if (raw) {
         try {
             cookieUtm = JSON.parse(raw);

package/dist/audiences/collectors/utm.js.map

@@ -1 +1 @@
-{"version":3,"file":"utm.js","sourceRoot":"","sources":["../../../src/audiences/collectors/utm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAU5C,MAAM,UAAU,UAAU,CAAC,GAAY,EAAE,OAA4B;IACnE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,SAAS,GAAwB,EAAE,CAAA;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAA;IACzC,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IACnF,CAAC;IACD,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,MAAM,IAAI,IAAI;QACtE,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,MAAM,IAAI,IAAI;QACtE,QAAQ,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC,QAAQ,IAAI,IAAI;QAC5E,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,IAAI,IAAI,IAAI;QAChE,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC,OAAO,IAAI,IAAI;KAC1E,CAAA;AACH,CAAC"}
+{"version":3,"file":"utm.js","sourceRoot":"","sources":["../../../src/audiences/collectors/utm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,qBAAqB,EAA2B,MAAM,eAAe,CAAA;AAU9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,UAAU,CACxB,GAAY,EACZ,OAA4B,EAC5B,OAA8D,EAAE;IAEhE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,SAAS,GAAwB,EAAE,CAAA;IACvC,MAAM,GAAG,GAAG,qBAAqB,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC;QACvG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC;QAC/B,CAAC,CAAC,SAAS,CAAA;IACb,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IACnF,CAAC;IACD,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,MAAM,IAAI,IAAI;QACtE,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,MAAM,IAAI,IAAI;QACtE,QAAQ,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC,QAAQ,IAAI,IAAI;QAC5E,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,IAAI,IAAI,IAAI;QAChE,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC,OAAO,IAAI,IAAI;KAC1E,CAAA;AACH,CAAC"}

package/dist/audiences/consent-config.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Resolve `theme.personalization.requireConsent` from a `KywiConfig`
+ * (kywi-cms#91).
+ *
+ * Kept out of `./consent.ts` because that module must import nothing at all —
+ * it is pulled into Next.js edge middleware. This file's only import is a TYPE,
+ * which erases at compile time, but it lives next door rather than inside the
+ * gate so the edge entry stays obviously dependency-free.
+ */
+import type { KywiConfig } from '../config/types.js';
+/**
+ * Does this site require consent before personalization cookies are written?
+ *
+ * **True unless a theme explicitly opts out.** The flag lives on the theme, so
+ * it resolves the same way `clientRuntimeEnabled` / `transparencyNoticeEnabled`
+ * do in the reference app: the named site's theme, falling back to the first
+ * site's theme and then the first theme declared. A site with no theme at all
+ * requires consent — the safe answer is the default answer.
+ */
+export declare function personalizationRequiresConsent(config: KywiConfig, siteId?: string): boolean;
+//# sourceMappingURL=consent-config.d.ts.map

package/dist/audiences/consent-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent-config.d.ts","sourceRoot":"","sources":["../../src/audiences/consent-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAEpD;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAI3F"}

package/dist/audiences/consent-config.js

@@ -0,0 +1,15 @@
+/**
+ * Does this site require consent before personalization cookies are written?
+ *
+ * **True unless a theme explicitly opts out.** The flag lives on the theme, so
+ * it resolves the same way `clientRuntimeEnabled` / `transparencyNoticeEnabled`
+ * do in the reference app: the named site's theme, falling back to the first
+ * site's theme and then the first theme declared. A site with no theme at all
+ * requires consent — the safe answer is the default answer.
+ */
+export function personalizationRequiresConsent(config, siteId) {
+    const site = (siteId ? config.sites.find((s) => s.id === siteId) : undefined) ?? config.sites[0];
+    const theme = config.themes.find((t) => t.name === site?.theme) ?? config.themes[0];
+    return theme?.personalization?.requireConsent !== false;
+}
+//# sourceMappingURL=consent-config.js.map

package/dist/audiences/consent-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent-config.js","sourceRoot":"","sources":["../../src/audiences/consent-config.ts"],"names":[],"mappings":"AAWA;;;;;;;;GAQG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAAkB,EAAE,MAAe;IAChF,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAChG,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IACnF,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,KAAK,KAAK,CAAA;AACzD,CAAC"}

package/dist/audiences/consent-startup.d.ts

@@ -0,0 +1,39 @@
+import type { KywiDb } from '../db/client.js';
+/** The env var mirroring `theme.personalization.requireConsent` for edge middleware. */
+export declare const REQUIRE_CONSENT_ENV = "KYWI_REQUIRE_CONSENT";
+/** How `middleware.ts` reads the mirror: anything but the literal "false" is true. */
+export declare function requireConsentFromEnv(env?: Record<string, string | undefined>): boolean;
+/**
+ * Fail startup when the config flag and its edge mirror disagree.
+ *
+ * Deliberately a throw and not a warning: the two halves of one setting pointing
+ * opposite ways is never intentional, and the resulting behaviour (cookies
+ * written by the edge that the API then declines to read, or vice versa) is
+ * exactly the kind of bug that survives to production because nothing is
+ * visibly broken.
+ */
+export declare function assertConsentEnvAgreement(requireConsentFromConfig: boolean, env?: Record<string, string | undefined>): void;
+/**
+ * Build the once-only "consent required, but nothing asks for it" check.
+ *
+ * Returns a function safe to call on every request: it runs at most once, never
+ * awaits (the first request does not pay for it), and swallows every error. A
+ * warning that could break a page, or add latency to the hot path, would not be
+ * worth having.
+ *
+ * The check is a `::text LIKE` prefilter — the same shape
+ * `checkAudienceDeletionSafety` uses — looking for anything that mentions the
+ * module type at all. Over-matching is fine here: a false negative (staying
+ * quiet) is the safe direction for an advisory warning.
+ *
+ * It reads BOTH places a module can be placed: `kywi_content.layout` and
+ * `kywi_section_templates.definition`. A banner composed from a blueprint is a
+ * banner, and scanning pages alone told a site that builds every page that way
+ * that consent could never be granted — while the banner was on screen.
+ */
+export declare function createConsentBannerCheck(deps: {
+    db: KywiDb;
+    requireConsent: boolean;
+    warn?: (message: string) => void;
+}): () => void;
+//# sourceMappingURL=consent-startup.d.ts.map

package/dist/audiences/consent-startup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent-startup.d.ts","sourceRoot":"","sources":["../../src/audiences/consent-startup.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,wFAAwF;AACxF,eAAO,MAAM,mBAAmB,yBAAyB,CAAA;AAEzD,sFAAsF;AACtF,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,OAAO,CAEpG;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,wBAAwB,EAAE,OAAO,EACjC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,IAAI,CAcN;AASD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,EAAE,EAAE,MAAM,CAAA;IACV,cAAc,EAAE,OAAO,CAAA;IACvB,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CACjC,GAAG,MAAM,IAAI,CA8Bb"}

package/dist/audiences/consent-startup.js

@@ -0,0 +1,105 @@
+/**
+ * Startup checks for the cookie-consent gate (kywi-cms#91).
+ *
+ * Two failure modes are invisible at runtime and expensive to discover later:
+ *
+ *   1. The config flag and its edge mirror disagree. `middleware.ts` runs on the
+ *      edge and cannot read `kywi.config.ts`, so `requireConsent` is mirrored as
+ *      `KYWI_REQUIRE_CONSENT`. If the two drift, the middleware and the API
+ *      disagree about whether a visitor may be tracked — one writes
+ *      `kywi_visitor`, the other refuses to read it — and nothing anywhere says
+ *      so. That is a misconfiguration, and it fails the deploy.
+ *
+ *   2. Consent is required and no page offers a way to give it. Every
+ *      personalization cookie is then permanently suppressed: audiences,
+ *      experiments and UTM attribution quietly do nothing, and the site looks
+ *      broken rather than gated. That is a WARNING, not an error — a site may
+ *      legitimately have no personalization at all — but it must be said out
+ *      loud, once, rather than left for someone to debug.
+ */
+import { sql } from 'drizzle-orm';
+/** The env var mirroring `theme.personalization.requireConsent` for edge middleware. */
+export const REQUIRE_CONSENT_ENV = 'KYWI_REQUIRE_CONSENT';
+/** How `middleware.ts` reads the mirror: anything but the literal "false" is true. */
+export function requireConsentFromEnv(env = process.env) {
+    return env[REQUIRE_CONSENT_ENV] !== 'false';
+}
+/**
+ * Fail startup when the config flag and its edge mirror disagree.
+ *
+ * Deliberately a throw and not a warning: the two halves of one setting pointing
+ * opposite ways is never intentional, and the resulting behaviour (cookies
+ * written by the edge that the API then declines to read, or vice versa) is
+ * exactly the kind of bug that survives to production because nothing is
+ * visibly broken.
+ */
+export function assertConsentEnvAgreement(requireConsentFromConfig, env = process.env) {
+    const fromEnv = requireConsentFromEnv(env);
+    if (fromEnv === requireConsentFromConfig)
+        return;
+    const raw = env[REQUIRE_CONSENT_ENV];
+    throw new Error(`Cookie-consent misconfiguration: theme.personalization.requireConsent is ` +
+        `${requireConsentFromConfig} but ${REQUIRE_CONSENT_ENV} is ` +
+        `${raw === undefined ? 'unset (which means true)' : JSON.stringify(raw)}.\n` +
+        `  Next.js edge middleware cannot read kywi.config.ts, so it mirrors that flag ` +
+        `through ${REQUIRE_CONSENT_ENV}. While they disagree, the middleware and the API ` +
+        `disagree about whether a visitor may be tracked.\n` +
+        `  Set both, or neither: ${REQUIRE_CONSENT_ENV}=false alongside ` +
+        `personalization: { requireConsent: false }, or remove both.`);
+}
+const NO_BANNER_WARNING = '[kywi] Cookie consent is required (theme.personalization.requireConsent) but no ' +
+    'page or layout places the `cookieConsent` module, so no visitor can ever grant it. ' +
+    'Every personalization cookie stays suppressed: audiences, A/B bucketing and UTM ' +
+    'attribution will resolve to default content for everyone. Place the module, or set ' +
+    'personalization: { requireConsent: false } if consent is collected by external tooling.';
+/**
+ * Build the once-only "consent required, but nothing asks for it" check.
+ *
+ * Returns a function safe to call on every request: it runs at most once, never
+ * awaits (the first request does not pay for it), and swallows every error. A
+ * warning that could break a page, or add latency to the hot path, would not be
+ * worth having.
+ *
+ * The check is a `::text LIKE` prefilter — the same shape
+ * `checkAudienceDeletionSafety` uses — looking for anything that mentions the
+ * module type at all. Over-matching is fine here: a false negative (staying
+ * quiet) is the safe direction for an advisory warning.
+ *
+ * It reads BOTH places a module can be placed: `kywi_content.layout` and
+ * `kywi_section_templates.definition`. A banner composed from a blueprint is a
+ * banner, and scanning pages alone told a site that builds every page that way
+ * that consent could never be granted — while the banner was on screen.
+ */
+export function createConsentBannerCheck(deps) {
+    const warn = deps.warn ?? ((m) => console.warn(m));
+    let started = false;
+    return () => {
+        if (started || !deps.requireConsent)
+            return;
+        started = true;
+        void (async () => {
+            try {
+                const rows = await deps.db.execute(sql `
+            SELECT 1 AS found
+            FROM kywi_content
+            WHERE layout IS NOT NULL
+              AND layout::text LIKE ${'%"cookieConsent"%'}
+            UNION ALL
+            SELECT 1 AS found
+            FROM kywi_section_templates
+            WHERE definition IS NOT NULL
+              AND definition::text LIKE ${'%"cookieConsent"%'}
+            LIMIT 1
+          `);
+                if (rows.length === 0)
+                    warn(NO_BANNER_WARNING);
+            }
+            catch {
+                // No content table yet (a fresh install mid-migration), a dialect that
+                // cannot cast, a transient connection failure — none of that is worth
+                // failing or logging a request over. Silence is the safe direction.
+            }
+        })();
+    };
+}
+//# sourceMappingURL=consent-startup.js.map

package/dist/audiences/consent-startup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent-startup.js","sourceRoot":"","sources":["../../src/audiences/consent-startup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAGjC,wFAAwF;AACxF,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAA;AAEzD,sFAAsF;AACtF,MAAM,UAAU,qBAAqB,CAAC,MAA0C,OAAO,CAAC,GAAG;IACzF,OAAO,GAAG,CAAC,mBAAmB,CAAC,KAAK,OAAO,CAAA;AAC7C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,wBAAiC,EACjC,MAA0C,OAAO,CAAC,GAAG;IAErD,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAA;IAC1C,IAAI,OAAO,KAAK,wBAAwB;QAAE,OAAM;IAChD,MAAM,GAAG,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAA;IACpC,MAAM,IAAI,KAAK,CACb,2EAA2E;QACzE,GAAG,wBAAwB,QAAQ,mBAAmB,MAAM;QAC5D,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK;QAC5E,gFAAgF;QAChF,WAAW,mBAAmB,oDAAoD;QAClF,oDAAoD;QACpD,2BAA2B,mBAAmB,mBAAmB;QACjE,6DAA6D,CAChE,CAAA;AACH,CAAC;AAED,MAAM,iBAAiB,GACrB,kFAAkF;IAClF,qFAAqF;IACrF,kFAAkF;IAClF,qFAAqF;IACrF,yFAAyF,CAAA;AAE3F;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAIxC;IACC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1D,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,OAAO,GAAG,EAAE;QACV,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc;YAAE,OAAM;QAC3C,OAAO,GAAG,IAAI,CAAA;QACd,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,OAAO,CAChC,GAAG,CAAA;;;;sCAIyB,mBAAmB;;;;;0CAKf,mBAAmB;;WAElD,CACF,CAAA;gBACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBAAE,IAAI,CAAC,iBAAiB,CAAC,CAAA;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,uEAAuE;gBACvE,sEAAsE;gBACtE,oEAAoE;YACtE,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;IACN,CAAC,CAAA;AACH,CAAC"}