@kywi-software/js 0.13.0 → 0.15.0

package/dist/kywi.js

@@ -21,14 +21,22 @@ var Kywi = (() => {
   // src/index.ts
   var src_exports = {};
   __export(src_exports, {
+    AUDIENCE_PIN_COOKIE: () => AUDIENCE_PIN_COOKIE,
+    CONSENT_COOKIE: () => CONSENT_COOKIE,
+    COOKIE_CONSENT_CATEGORY: () => COOKIE_CONSENT_CATEGORY,
     Kywi: () => Kywi,
     NAV_BREAKPOINT: () => NAV_BREAKPOINT,
+    SWITCHER_PIN_PREFIX: () => SWITCHER_PIN_PREFIX,
     bootAudienceEngine: () => bootAudienceEngine,
     bootExperiments: () => bootExperiments,
+    clearDeniedCookies: () => clearDeniedCookies,
     enhanceNav: () => enhanceNav,
+    getConsentState: () => getConsentState,
+    hasConsent: () => hasConsent,
     initNavMenus: () => initNavMenus,
     openTransparencyPanel: () => openTransparencyPanel,
-    renderTransparencyPanel: () => renderTransparencyPanel
+    renderTransparencyPanel: () => renderTransparencyPanel,
+    setConsent: () => setConsent
   });
 
   // src/context.ts
@@ -904,7 +912,9 @@ var Kywi = (() => {
       el.removeAttribute("aria-busy");
       const skeleton = el.querySelector(".kywi-variant-skeleton");
       if (skeleton) skeleton.remove();
-      const target = winningAudienceId ?? "default";
+      const requested = winningAudienceId ?? "default";
+      const hasMatch = arms.some((child) => child.getAttribute("data-kywi-variant") === requested);
+      const target = hasMatch ? requested : "default";
       el.setAttribute("data-variant", target);
       for (const child of arms) {
         const h = child;
@@ -999,14 +1009,26 @@ var Kywi = (() => {
   async function pinAudience(audienceId, opts = {}) {
     const apiBase = opts.apiBase ?? DEFAULT_API_BASE;
     try {
-      await fetch(`${apiBase}/kywi/audience`, {
+      const res = await fetch(`${apiBase}/kywi/audience`, {
         method: "POST",
         headers: { "Content-Type": "application/json", ...opts.csrfToken ? { "X-CSRF-Token": opts.csrfToken } : {} },
-        body: JSON.stringify({ audienceId })
+        body: JSON.stringify({ audienceId, source: "switcher" })
       });
+      if (!res.ok) return false;
+      const body = await res.json().catch(() => null);
+      return body?.data?.persisted !== false;
     } catch {
+      return false;
     }
   }
+  function showSwitcherError(group) {
+    group.parentElement?.querySelector(".kywi-transparency-switcher-error")?.remove();
+    const note = document.createElement("p");
+    note.className = "kywi-transparency-switcher-error";
+    note.setAttribute("role", "status");
+    note.textContent = "Couldn't save that choice. It won't be remembered on the next page.";
+    group.parentElement?.appendChild(note);
+  }
   function reload() {
     try {
       window.location.reload();
@@ -1111,7 +1133,12 @@ var Kywi = (() => {
         const isCurrent = option.id === state.audienceId;
         const optionBtn = button("kywi-transparency-option", option.name, () => {
           if (isCurrent) return;
-          void pinAudience(option.id, { apiBase: state.apiBase, csrfToken: state.csrfToken }).then(reload);
+          void pinAudience(option.id, { apiBase: state.apiBase, csrfToken: state.csrfToken }).then(
+            (persisted) => {
+              if (persisted) reload();
+              else showSwitcherError(group);
+            }
+          );
         });
         optionBtn.dataset.kywiAudienceId = option.id;
         optionBtn.setAttribute("aria-pressed", String(isCurrent));
@@ -1242,6 +1269,74 @@ var Kywi = (() => {
     return { audienceId: m("audience-id"), experimentId: m("experiment-id"), variantId: m("variant-id"), visitorId: m("visitor-id") ?? "" };
   }
 
+  // src/consent.ts
+  var CONSENT_COOKIE = "kywi_consent";
+  var AUDIENCE_PIN_COOKIE = "kywi_audience";
+  var SWITCHER_PIN_PREFIX = "switcher:";
+  var COOKIE_CONSENT_CATEGORY = {
+    kywi_consent: "essential",
+    kywi_optout: "essential",
+    kywi_preview_init: "essential",
+    kywi_signals: "personalization",
+    kywi_visitor: "personalization",
+    kywi_utm: "personalization",
+    kywi_audience: "personalization",
+    kywi_known: "personalization"
+  };
+  function getConsentState() {
+    const cookies = readCookies();
+    const raw = cookies.get(CONSENT_COOKIE);
+    if (!raw) return null;
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      return null;
+    }
+    if (typeof parsed !== "object" || parsed === null) return null;
+    const obj = parsed;
+    return {
+      essential: true,
+      analytics: obj.analytics === true,
+      marketing: obj.marketing === true,
+      personalization: obj.personalization === true
+    };
+  }
+  function setConsent(prefs) {
+    const state = {
+      essential: true,
+      analytics: prefs.analytics ?? false,
+      marketing: prefs.marketing ?? false,
+      personalization: prefs.personalization ?? false
+    };
+    setCookie(CONSENT_COOKIE, JSON.stringify(state), 31536e3);
+    clearDeniedCookies(state);
+  }
+  function clearDeniedCookies(state) {
+    if (typeof document === "undefined") return [];
+    const cookies = readCookies();
+    const deleted = [];
+    for (const [name, category] of Object.entries(COOKIE_CONSENT_CATEGORY)) {
+      if (category === "essential") continue;
+      if (state && state[category] === true) continue;
+      if (isDeliberatePreference(name, cookies.get(name))) continue;
+      deleteCookie(name);
+      deleted.push(name);
+    }
+    return deleted;
+  }
+  function isDeliberatePreference(name, value) {
+    if (name !== AUDIENCE_PIN_COOKIE || value === void 0) return false;
+    return value.startsWith(SWITCHER_PIN_PREFIX) && value.length > SWITCHER_PIN_PREFIX.length;
+  }
+  function hasConsent(category, options = {}) {
+    if (options.requireConsent === false) return true;
+    if (category === "essential") return true;
+    const state = getConsentState();
+    if (!state) return false;
+    return state[category] === true;
+  }
+
   // src/audience/adapter-runner.ts
   var CACHE_PREFIX = "kywi_adapter_";
   function getCached(adapterId) {
@@ -1587,9 +1682,12 @@ var Kywi = (() => {
       return;
     }
     const cookies = readCookies();
+    const consentGate = config.requireConsent === void 0 ? {} : { requireConsent: config.requireConsent };
+    const mayPersonalize = hasConsent("personalization", consentGate);
+    const storedVisitorId = mayPersonalize ? cookies.get(COOKIE_NAMES.VISITOR) : void 0;
     let merged = {
       ...serverSignals,
-      identity: { visitorId: serverMeta.visitorId || cookies.get(COOKIE_NAMES.VISITOR) || "", isKnown: cookies.has(COOKIE_NAMES.KNOWN), maLeadId: null },
+      identity: { visitorId: serverMeta.visitorId || storedVisitorId || "", isKnown: mayPersonalize && cookies.has(COOKIE_NAMES.KNOWN), maLeadId: null },
       meta: { isOptedOut: cookies.has(COOKIE_NAMES.OPTOUT), isPreview: false, previewAudienceId: null, resolvedAt: "server" }
     };
     if (config.adapters && config.adapters.length > 0) {
@@ -1597,7 +1695,8 @@ var Kywi = (() => {
       merged.adapters = { ...merged.adapters, ...adapterResults };
     }
     const result = evaluateClientSide(audiences, merged, currentPath, pageCategory);
-    const pinnedId = cookies.get(COOKIE_NAMES.AUDIENCE) ?? null;
+    const rawPin = cookies.get(COOKIE_NAMES.AUDIENCE) ?? null;
+    const pinnedId = rawPin?.startsWith("switcher:") ? rawPin.slice("switcher:".length) || null : rawPin;
     const isPinned = !result.isOptedOut && pinnedId !== null && activeAudiences.some((a) => a.id === pinnedId);
     const effectiveAudienceId = isPinned ? pinnedId : result.winningAudienceId;
     patchVariantContainers(effectiveAudienceId);
@@ -1614,11 +1713,14 @@ var Kywi = (() => {
     renderPersonalizationBadge({ audienceName: nameOf(effectiveAudienceId) });
     populateDataLayer({ visitorId: result.signals.identity.visitorId, audienceId: effectiveAudienceId, experimentId: serverMeta.experimentId, variantId: serverMeta.variantId, isPreview: false, isOptedOut: result.isOptedOut });
     fireKywiReady();
-    if (!isPinned && result.winningAudienceId && result.winningAudienceId !== serverMeta.audienceId) {
+    if (!isPinned && mayPersonalize && result.winningAudienceId && result.winningAudienceId !== serverMeta.audienceId) {
       fetch(`${apiBase}/kywi/audience`, {
         method: "POST",
         headers: { "Content-Type": "application/json", ...Kywi.context?.csrfToken ? { "X-CSRF-Token": Kywi.context.csrfToken } : {} },
-        body: JSON.stringify({ audienceId: result.winningAudienceId })
+        // Explicitly the AUTOMATIC write, so the server applies the
+        // personalization gate to it (kywi-cms#91). The transparency panel's
+        // hand-operated switcher sends source:'switcher' and is exempt.
+        body: JSON.stringify({ audienceId: result.winningAudienceId, source: "boot" })
       }).catch(() => {
       });
     }