@leapio/web 0.0.0-stage → 1.0.1

package/dist/index.mjs

@@ -0,0 +1,3622 @@
+//#region src/cookie.ts
+const LEGACY_UID_COOKIE = "lgspt_uid";
+const ONE_DAY_IN_SECONDS = 86400;
+const ONE_YEAR_IN_SECONDS = 360 * ONE_DAY_IN_SECONDS;
+const setCookie = ({ name, value, expiresInSeconds, domain }) => {
+	let date = /* @__PURE__ */ new Date();
+	date.setTime(date.getTime() + expiresInSeconds * 1e3);
+	const expires = "; expires=" + date.toUTCString();
+	const domainProperty = domain ? `; domain=${domain}` : "";
+	document.cookie = name + "=" + (value || "") + domainProperty + expires + "; path=/";
+};
+const getCookie = (name) => {
+	const nameEQ = name + "=";
+	const ca = document.cookie.split(";");
+	for (var i = 0; i < ca.length; i++) {
+		let c = ca[i];
+		while (c.charAt(0) == " ") c = c.substring(1, c.length);
+		if (c.indexOf(nameEQ) == 0) return c.substring(nameEQ.length, c.length);
+	}
+	return null;
+};
+const eraseCookie = (name, domain) => {
+	const domainProperty = domain ? `; Domain=${domain}` : "";
+	document.cookie = name + `=; Path=/${domainProperty}; Expires=Thu, 01 Jan 1970 00:00:01 GMT;`;
+};
+//#endregion
+//#region src/safe-storage.ts
+const safeLocalStorage = () => {
+	try {
+		if (typeof window === "undefined" || !window.localStorage) return null;
+		const probeKey = "__leapio_probe__";
+		window.localStorage.setItem(probeKey, "1");
+		window.localStorage.removeItem(probeKey);
+		return window.localStorage;
+	} catch (_unused) {
+		return null;
+	}
+};
+//#endregion
+//#region src/anonymous-id.ts
+const ANONYMOUS_ID_KEY = "leapio_anonymous_id";
+const LEGACY_ANONYMOUS_ID_KEY = "lgspt_anonymous_id";
+const MAX_ANONYMOUS_ID_LENGTH = 64;
+/**
+* Generate a v4 UUID. Prefer crypto.randomUUID() (modern browsers); fall back
+* to a Math.random-based implementation for older environments.
+*/
+const generateAnonymousId = () => {
+	try {
+		const c = typeof crypto !== "undefined" ? crypto : void 0;
+		if (c && typeof c.randomUUID === "function") return c.randomUUID();
+	} catch (_unused) {}
+	return "xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g, (c) => {
+		const r = Math.random() * 16 | 0;
+		return (c === "x" ? r : r & 3 | 8).toString(16);
+	});
+};
+const tryReadCookie$1 = (name) => {
+	try {
+		return getCookie(name);
+	} catch (_unused2) {
+		return null;
+	}
+};
+const tryWriteCookie$1 = (value, opts) => {
+	try {
+		var _opts$cookieExpiratio, _opts$cookieDomain;
+		setCookie({
+			name: ANONYMOUS_ID_KEY,
+			value,
+			expiresInSeconds: (_opts$cookieExpiratio = opts.cookieExpirationInSeconds) !== null && _opts$cookieExpiratio !== void 0 ? _opts$cookieExpiratio : ONE_YEAR_IN_SECONDS,
+			domain: (_opts$cookieDomain = opts.cookieDomain) !== null && _opts$cookieDomain !== void 0 ? _opts$cookieDomain : null
+		});
+		return getCookie(ANONYMOUS_ID_KEY) === value;
+	} catch (_unused3) {
+		return false;
+	}
+};
+const tryReadLocalStorage$1 = (key) => {
+	const ls = safeLocalStorage();
+	if (!ls) return null;
+	try {
+		return ls.getItem(key);
+	} catch (_unused4) {
+		return null;
+	}
+};
+const tryWriteLocalStorage$1 = (value) => {
+	const ls = safeLocalStorage();
+	if (!ls) return false;
+	try {
+		ls.setItem(ANONYMOUS_ID_KEY, value);
+		return true;
+	} catch (_unused5) {
+		return false;
+	}
+};
+let inMemoryAnonymousId = null;
+/**
+* Read existing anonymous id from cookie -> legacy SDK cookie -> localStorage
+* -> in-memory. The legacy `lgspt_uid` cookie was the old anonymous browser id;
+* migrating it preserves pre-identify history without continuing to send it as
+* `user_id`.
+*/
+const readAnonymousId = (opts) => {
+	var _tryReadLocalStorage;
+	if (!opts.cookiesDisabled) {
+		var _tryReadCookie;
+		const fromCookie = (_tryReadCookie = tryReadCookie$1("leapio_anonymous_id")) !== null && _tryReadCookie !== void 0 ? _tryReadCookie : tryReadCookie$1(LEGACY_ANONYMOUS_ID_KEY);
+		if (fromCookie) return fromCookie;
+		const fromLegacyCookie = tryReadCookie$1(LEGACY_UID_COOKIE);
+		if (fromLegacyCookie && fromLegacyCookie.length <= MAX_ANONYMOUS_ID_LENGTH) return fromLegacyCookie;
+	}
+	const fromLs = (_tryReadLocalStorage = tryReadLocalStorage$1("leapio_anonymous_id")) !== null && _tryReadLocalStorage !== void 0 ? _tryReadLocalStorage : tryReadLocalStorage$1(LEGACY_ANONYMOUS_ID_KEY);
+	if (fromLs) return fromLs;
+	return inMemoryAnonymousId;
+};
+/**
+* Persist the anonymous id through the storage chain. Cookie attempted first
+* (unless disabled), then localStorage, then in-memory as last resort.
+*/
+const writeAnonymousId = (value, opts) => {
+	if (!opts.cookiesDisabled) tryWriteCookie$1(value, opts);
+	tryWriteLocalStorage$1(value);
+	inMemoryAnonymousId = value;
+};
+/** Clear the anonymous id from every storage layer. Used by reset(). */
+const clearAnonymousId = (opts) => {
+	for (const name of [
+		ANONYMOUS_ID_KEY,
+		LEGACY_ANONYMOUS_ID_KEY,
+		LEGACY_UID_COOKIE
+	]) try {
+		var _opts$cookieDomain2;
+		eraseCookie(name, (_opts$cookieDomain2 = opts.cookieDomain) !== null && _opts$cookieDomain2 !== void 0 ? _opts$cookieDomain2 : null);
+	} catch (_unused6) {}
+	const ls = safeLocalStorage();
+	if (ls) try {
+		ls.removeItem(ANONYMOUS_ID_KEY);
+		ls.removeItem(LEGACY_ANONYMOUS_ID_KEY);
+	} catch (_unused7) {}
+	inMemoryAnonymousId = null;
+};
+/**
+* Get-or-create: return existing anonymous id if present, otherwise generate
+* a new one and persist it.
+*/
+const ensureAnonymousId = (opts) => {
+	const existing = readAnonymousId(opts);
+	if (existing) {
+		inMemoryAnonymousId = existing;
+		writeAnonymousId(existing, opts);
+		return existing;
+	}
+	const fresh = generateAnonymousId();
+	writeAnonymousId(fresh, opts);
+	return fresh;
+};
+/** Force-rotate: generate a new anonymous id, clear all old layers, persist new. */
+const rotateAnonymousId = (opts) => {
+	clearAnonymousId(opts);
+	const fresh = generateAnonymousId();
+	writeAnonymousId(fresh, opts);
+	return fresh;
+};
+//#endregion
+//#region src/ac-overrides.ts
+/** localStorage key prefix; the public key is appended for per-project dedup. */
+const AC_OVERRIDES_KEY_PREFIX = "leapio_acov_";
+const keyFor$1 = (publicKey) => `${AC_OVERRIDES_KEY_PREFIX}${publicKey}`;
+/** The per-type keys the SDK reports (the server-controllable types). */
+const REPORTED_TYPE_KEYS = [
+	"outboundLinks",
+	"fileDownloads",
+	"formSubmissions",
+	"mediaPlayback"
+];
+/**
+* Build the EXPLICIT snippet-override report from the normalized snippet shape
+* (`{ master, types }` produced by `normalizeSnippet`) plus the legacy
+* `enableAutoClicks` flag. Only keys the snippet explicitly set are included:
+*
+* - `master` is included (as `true`/`false`) only when the snippet/host set it.
+*   `enableAutoClicks: true` counts as a snippet-side master-enable (matching the
+*   resolver), but only when the snippet did not already set the master.
+* - `types` is included only when the snippet explicitly set one of the
+*   server-controllable types (`outboundLinks` / `fileDownloads` /
+*   `formSubmissions` / `mediaPlayback`). `clicks` / `inputChanges` are
+*   snippet-only knobs the server doesn't model, so they are not reported.
+*
+* Returns an empty object `{}` when the snippet set nothing reportable (the
+* common case). `master` carries the explicit boolean; absent means unset.
+*/
+const buildSnippetOverrideReport = (normalized, enableAutoClicks) => {
+	const report = {};
+	const master = typeof normalized.master === "boolean" ? normalized.master : enableAutoClicks ? true : void 0;
+	if (typeof master === "boolean") report.master = master;
+	const types = {};
+	for (const key of REPORTED_TYPE_KEYS) {
+		const value = normalized.types[key];
+		if (typeof value === "boolean") types[key] = value;
+	}
+	if (Object.keys(types).length > 0) report.types = types;
+	return report;
+};
+/**
+* Whether a built report carries any explicit override (a master or any type).
+* The empty report `{}` means "the snippet overrode nothing."
+*/
+const hasSnippetOverrides = (report) => "master" in report || report.types !== void 0;
+/**
+* Stable fingerprint of a snippet-override report: the JSON of the report with
+* type keys emitted in a fixed order, so logically-equal reports always produce
+* an identical string regardless of insertion order. Returns "" for the empty
+* (no-overrides) report.
+*/
+const computeOverrideFingerprint = (report) => {
+	if (!hasSnippetOverrides(report)) return "";
+	const canonical = {};
+	if (typeof report.master === "boolean") canonical.master = report.master;
+	if (report.types) {
+		const orderedTypes = {};
+		for (const key of REPORTED_TYPE_KEYS) {
+			const value = report.types[key];
+			if (typeof value === "boolean") orderedTypes[key] = value;
+		}
+		canonical.types = orderedTypes;
+	}
+	try {
+		return JSON.stringify(canonical);
+	} catch (_unused) {
+		return "";
+	}
+};
+/** Read the last-reported fingerprint for a public key. Never throws; "" when absent. */
+const readReportedFingerprint = (publicKey) => {
+	if (!publicKey) return "";
+	const ls = safeLocalStorage();
+	if (!ls) return "";
+	try {
+		var _ls$getItem;
+		return (_ls$getItem = ls.getItem(keyFor$1(publicKey))) !== null && _ls$getItem !== void 0 ? _ls$getItem : "";
+	} catch (_unused2) {
+		return "";
+	}
+};
+/** Persist the last-reported fingerprint for a public key. Best-effort; never throws. */
+const writeReportedFingerprint = (publicKey, fingerprint) => {
+	if (!publicKey) return;
+	const ls = safeLocalStorage();
+	if (!ls) return;
+	try {
+		ls.setItem(keyFor$1(publicKey), fingerprint);
+	} catch (_unused3) {}
+};
+/** Remove the stored fingerprint for a public key. Never throws. */
+const clearReportedFingerprint = (publicKey) => {
+	if (!publicKey) return;
+	const ls = safeLocalStorage();
+	if (!ls) return;
+	try {
+		ls.removeItem(keyFor$1(publicKey));
+	} catch (_unused4) {}
+};
+/**
+* Decide whether to attach `_acOverrides` to the next track request, and update
+* the stored fingerprint so the same override set is reported at most once per
+* browser. All localStorage access is best-effort and never throws.
+*
+* Cases:
+* - Snippet has overrides AND the fingerprint differs from the last reported one
+*   → return the report (with `url`) and persist the new fingerprint.
+* - Snippet has NO overrides BUT a non-empty fingerprint was stored → send the
+*   CLEAR report once (`{ snippet: { types: {} } }`, no master) so the server
+*   clears the flag, then clear the stored fingerprint.
+* - Snippet has no overrides and nothing was previously reported → return null
+*   (send nothing — the common case).
+* - Fingerprint unchanged → return null (already reported).
+*
+* The store is updated synchronously here (before the request resolves) so a
+* second event in the same page load does not re-attach the report.
+*/
+const resolveAcOverridesToReport = (params) => {
+	const { publicKey, report } = params;
+	if (!publicKey) return null;
+	try {
+		const fingerprint = computeOverrideFingerprint(report);
+		if (fingerprint === readReportedFingerprint(publicKey)) return null;
+		if (fingerprint === "") {
+			clearReportedFingerprint(publicKey);
+			return { snippet: { types: {} } };
+		}
+		writeReportedFingerprint(publicKey, fingerprint);
+		const out = { snippet: report };
+		if (params.url) out.url = params.url;
+		return out;
+	} catch (_unused5) {
+		return null;
+	}
+};
+//#endregion
+//#region \0@oxc-project+runtime@0.151.0/helpers/esm/typeof.js
+function _typeof(o) {
+	"@babel/helpers - typeof";
+	return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function(o) {
+		return typeof o;
+	} : function(o) {
+		return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o;
+	}, _typeof(o);
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.151.0/helpers/esm/toPrimitive.js
+function toPrimitive(t, r) {
+	if ("object" != _typeof(t) || !t) return t;
+	var e = t[Symbol.toPrimitive];
+	if (void 0 !== e) {
+		var i = e.call(t, r || "default");
+		if ("object" != _typeof(i)) return i;
+		throw new TypeError("@@toPrimitive must return a primitive value.");
+	}
+	return ("string" === r ? String : Number)(t);
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.151.0/helpers/esm/toPropertyKey.js
+function toPropertyKey(t) {
+	var i = toPrimitive(t, "string");
+	return "symbol" == _typeof(i) ? i : i + "";
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.151.0/helpers/esm/defineProperty.js
+function _defineProperty(e, r, t) {
+	return (r = toPropertyKey(r)) in e ? Object.defineProperty(e, r, {
+		value: t,
+		enumerable: !0,
+		configurable: !0,
+		writable: !0
+	}) : e[r] = t, e;
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.151.0/helpers/esm/objectSpread2.js
+function ownKeys(e, r) {
+	var t = Object.keys(e);
+	if (Object.getOwnPropertySymbols) {
+		var o = Object.getOwnPropertySymbols(e);
+		r && (o = o.filter(function(r) {
+			return Object.getOwnPropertyDescriptor(e, r).enumerable;
+		})), t.push.apply(t, o);
+	}
+	return t;
+}
+function _objectSpread2(e) {
+	for (var r = 1; r < arguments.length; r++) {
+		var t = null != arguments[r] ? arguments[r] : {};
+		r % 2 ? ownKeys(Object(t), !0).forEach(function(r) {
+			_defineProperty(e, r, t[r]);
+		}) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function(r) {
+			Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r));
+		});
+	}
+	return e;
+}
+//#endregion
+//#region src/consent.ts
+/**
+* Consent store for the Leapio SDK.
+*
+* Holds the current consent snapshot ({categories, signals, source, updatedAt})
+* and persists it through the same layered fallback chain used by
+* `anonymous-id.ts`: cookie (`leapio_consent`) -> localStorage -> in-memory.
+*
+* The store is *source-priority aware*: an external consent source (CMP plugin,
+* GCM reader, explicit Leapio API) writes a snapshot via `applySnapshot`, which
+* keeps the highest-priority snapshot authoritative. This lets a later plugins
+* agent register additional sources without re-architecting the store.
+*/
+const CONSENT_KEY = "leapio_consent";
+const LEGACY_CONSENT_KEY = "lgspt_consent";
+/** Category -> single-letter code. */
+const CATEGORY_TO_LETTER = {
+	analytics: "a",
+	functional: "f",
+	marketing: "m"
+};
+/** Canonical category order: a < f < m. */
+const CATEGORY_ORDER = [
+	"analytics",
+	"functional",
+	"marketing"
+];
+/** Signal -> single-letter code. */
+const SIGNAL_TO_LETTER = [
+	{
+		key: "doNotSellShare",
+		letter: "d"
+	},
+	{
+		key: "gpc",
+		letter: "g"
+	},
+	{
+		key: "gppDetected",
+		letter: "p"
+	}
+];
+/**
+* Encode a set of granted categories into a canonical string (`a` < `f` < `m`).
+* Categories whose value is not strictly `true` are omitted.
+*/
+const encodeCategories = (categories) => {
+	let out = "";
+	for (const category of CATEGORY_ORDER) if (categories[category] === true) out += CATEGORY_TO_LETTER[category];
+	return out;
+};
+/**
+* Encode privacy signals into a canonical string (`d` < `g` < `p`).
+* Only signals whose value is strictly `true` are included; `gppString` is a
+* raw value carried separately and never encoded into `privacy_signals`.
+*/
+const encodeSignals = (signals) => {
+	let out = "";
+	for (const { key, letter } of SIGNAL_TO_LETTER) if (signals[key] === true) out += letter;
+	return out;
+};
+const SOURCE_PRIORITY = {
+	leapio_api: 100,
+	concord: 80,
+	onetrust: 60,
+	usercentrics: 60,
+	cookiebot: 60,
+	gcm: 40
+};
+/** Resolve a source's priority; unknown sources rank below all known ones. */
+const consentSourcePriority = (source) => {
+	var _SOURCE_PRIORITY;
+	return (_SOURCE_PRIORITY = SOURCE_PRIORITY[source]) !== null && _SOURCE_PRIORITY !== void 0 ? _SOURCE_PRIORITY : 0;
+};
+const serialize = (snapshot) => {
+	try {
+		return JSON.stringify(snapshot);
+	} catch (_unused) {
+		return "";
+	}
+};
+const deserialize = (raw) => {
+	if (!raw) return null;
+	try {
+		const parsed = JSON.parse(raw);
+		if (!parsed || typeof parsed !== "object" || typeof parsed.source !== "string") return null;
+		return {
+			categories: parsed.categories && typeof parsed.categories === "object" ? parsed.categories : {},
+			signals: parsed.signals && typeof parsed.signals === "object" ? parsed.signals : {},
+			source: parsed.source.endsWith("_api") ? "leapio_api" : parsed.source,
+			updatedAt: typeof parsed.updatedAt === "string" ? parsed.updatedAt : (/* @__PURE__ */ new Date()).toISOString(),
+			sourceMetadata: parsed.sourceMetadata && typeof parsed.sourceMetadata === "object" ? parsed.sourceMetadata : void 0
+		};
+	} catch (_unused2) {
+		return null;
+	}
+};
+const tryReadCookie = (key) => {
+	try {
+		const raw = getCookie(key);
+		return deserialize(raw ? decodeURIComponent(raw) : null);
+	} catch (_unused3) {
+		return null;
+	}
+};
+const tryWriteCookie = (snapshot, opts) => {
+	try {
+		var _opts$cookieExpiratio, _opts$cookieDomain;
+		setCookie({
+			name: CONSENT_KEY,
+			value: encodeURIComponent(serialize(snapshot)),
+			expiresInSeconds: (_opts$cookieExpiratio = opts.cookieExpirationInSeconds) !== null && _opts$cookieExpiratio !== void 0 ? _opts$cookieExpiratio : ONE_YEAR_IN_SECONDS,
+			domain: (_opts$cookieDomain = opts.cookieDomain) !== null && _opts$cookieDomain !== void 0 ? _opts$cookieDomain : null
+		});
+	} catch (_unused4) {}
+};
+const tryReadLocalStorage = (key) => {
+	const ls = safeLocalStorage();
+	if (!ls) return null;
+	try {
+		return deserialize(ls.getItem(key));
+	} catch (_unused5) {
+		return null;
+	}
+};
+const tryWriteLocalStorage = (snapshot) => {
+	const ls = safeLocalStorage();
+	if (!ls) return;
+	try {
+		ls.setItem(CONSENT_KEY, serialize(snapshot));
+	} catch (_unused6) {}
+};
+let inMemorySnapshot = null;
+/**
+* Read the persisted snapshot: cookie -> localStorage -> in-memory.
+* Honors `cookiesDisabled` exactly like `readAnonymousId`.
+*/
+const readConsentSnapshot = (opts) => {
+	var _tryReadLocalStorage;
+	if (!opts.cookiesDisabled) {
+		var _tryReadCookie;
+		const fromCookie = (_tryReadCookie = tryReadCookie("leapio_consent")) !== null && _tryReadCookie !== void 0 ? _tryReadCookie : tryReadCookie(LEGACY_CONSENT_KEY);
+		if (fromCookie) return fromCookie;
+	}
+	const fromLs = (_tryReadLocalStorage = tryReadLocalStorage("leapio_consent")) !== null && _tryReadLocalStorage !== void 0 ? _tryReadLocalStorage : tryReadLocalStorage(LEGACY_CONSENT_KEY);
+	if (fromLs) return fromLs;
+	return inMemorySnapshot;
+};
+/**
+* Persist a snapshot through the storage chain. Cookie first (unless disabled),
+* then localStorage, then in-memory as the last-resort layer.
+*/
+const writeConsentSnapshot = (snapshot, opts) => {
+	if (!opts.cookiesDisabled) tryWriteCookie(snapshot, opts);
+	tryWriteLocalStorage(snapshot);
+	inMemorySnapshot = snapshot;
+};
+/** Clear the consent snapshot from every storage layer. Used by reset(). */
+const clearConsentSnapshot = (opts) => {
+	for (const name of [CONSENT_KEY, LEGACY_CONSENT_KEY]) try {
+		var _opts$cookieDomain2;
+		eraseCookie(name, (_opts$cookieDomain2 = opts.cookieDomain) !== null && _opts$cookieDomain2 !== void 0 ? _opts$cookieDomain2 : null);
+	} catch (_unused7) {}
+	const ls = safeLocalStorage();
+	if (ls) try {
+		ls.removeItem(CONSENT_KEY);
+		ls.removeItem(LEGACY_CONSENT_KEY);
+	} catch (_unused8) {}
+	inMemorySnapshot = null;
+};
+/**
+* Stateful wrapper around the persisted snapshot. The SDK keeps one instance.
+*
+* `applySnapshot(snapshot)` is the clean internal API external sources write
+* through: it enforces source priority (a lower-priority source never replaces
+* a higher-priority snapshot) and persists + returns whether it became
+* authoritative. The consent-source registry writes through this API.
+*/
+var ConsentStore = class {
+	constructor(opts) {
+		this.opts = opts;
+		this.current = readConsentSnapshot(opts);
+	}
+	/** The current authoritative snapshot, or null if no source has spoken. */
+	get() {
+		return this.current;
+	}
+	/** True once any source has produced a snapshot. */
+	hasSnapshot() {
+		return this.current !== null;
+	}
+	/**
+	* Apply a snapshot from a consent source. Returns `true` if it became (or
+	* remained) the authoritative snapshot and was persisted, `false` if it was
+	* rejected because a strictly higher-priority source is already authoritative.
+	*
+	* Ties (same source priority, e.g. a fresh read from the same source) always
+	* win so updates from the authoritative source are not dropped.
+	*/
+	applySnapshot(snapshot) {
+		if (this.current) {
+			if (consentSourcePriority(snapshot.source) < consentSourcePriority(this.current.source)) return false;
+		}
+		this.current = snapshot;
+		writeConsentSnapshot(snapshot, this.opts);
+		return true;
+	}
+	/**
+	* Merge a partial update into the snapshot from a given source. Used by
+	* `setConsent` (source `leapio_api`): unspecified categories/signals are
+	* preserved from the existing snapshot. Subject to the same priority rule.
+	*/
+	mergeSnapshot(partial, source) {
+		var _base$categories, _partial$categories, _base$signals, _partial$signals, _partial$sourceMetada;
+		const base = this.current;
+		const merged = {
+			categories: _objectSpread2(_objectSpread2({}, (_base$categories = base === null || base === void 0 ? void 0 : base.categories) !== null && _base$categories !== void 0 ? _base$categories : {}), (_partial$categories = partial.categories) !== null && _partial$categories !== void 0 ? _partial$categories : {}),
+			signals: _objectSpread2(_objectSpread2({}, (_base$signals = base === null || base === void 0 ? void 0 : base.signals) !== null && _base$signals !== void 0 ? _base$signals : {}), (_partial$signals = partial.signals) !== null && _partial$signals !== void 0 ? _partial$signals : {}),
+			source,
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			sourceMetadata: (_partial$sourceMetada = partial.sourceMetadata) !== null && _partial$sourceMetada !== void 0 ? _partial$sourceMetada : base === null || base === void 0 ? void 0 : base.sourceMetadata
+		};
+		return this.applySnapshot(merged);
+	}
+	/** Clear all consent state (every storage layer). Used by reset(). */
+	clear() {
+		clearConsentSnapshot(this.opts);
+		this.current = null;
+	}
+};
+//#endregion
+//#region src/remote-config.ts
+/** localStorage key prefix; the public key is appended for per-project caching. */
+const REMOTE_CONFIG_KEY_PREFIX = "leapio_cfg_";
+const keyFor = (publicKey) => `${REMOTE_CONFIG_KEY_PREFIX}${publicKey}`;
+/** Narrow an unknown parsed value to a cache envelope, or null. */
+const asCachedConfig = (value) => {
+	if (typeof value !== "object" || value === null) return null;
+	const candidate = value;
+	if (typeof candidate.cv !== "number" || typeof candidate.ts !== "number") return null;
+	if (typeof candidate.config !== "object" || candidate.config === null) return null;
+	return candidate;
+};
+/**
+* Read the cached config for a public key. Returns null when there is nothing
+* cached, when the cache format / TTL no longer matches, or when anything at
+* all goes wrong (corrupt JSON, unavailable storage). Never throws.
+*/
+const readRemoteConfig = (publicKey) => {
+	if (!publicKey) return null;
+	const ls = safeLocalStorage();
+	if (!ls) return null;
+	let raw;
+	try {
+		raw = ls.getItem(keyFor(publicKey));
+	} catch (_unused) {
+		return null;
+	}
+	if (!raw) return null;
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch (_unused2) {
+		return null;
+	}
+	const cached = asCachedConfig(parsed);
+	if (!cached) return null;
+	if (cached.cv !== 1) return null;
+	if (Date.now() - cached.ts > 864e5) return null;
+	return cached.config;
+};
+/**
+* Persist the config for a public key. Best-effort: silently no-ops when
+* storage is unavailable or the write fails. Never throws.
+*/
+const writeRemoteConfig = (publicKey, config) => {
+	if (!publicKey || typeof config !== "object" || config === null) return;
+	const ls = safeLocalStorage();
+	if (!ls) return;
+	const envelope = {
+		cv: 1,
+		ts: Date.now(),
+		config
+	};
+	try {
+		ls.setItem(keyFor(publicKey), JSON.stringify(envelope));
+	} catch (_unused3) {}
+};
+//#endregion
+//#region src/url-privacy.ts
+const DEFAULT_QUERY_PARAM_ALLOWLIST = [
+	"utm_source",
+	"utm_id",
+	"utm_medium",
+	"utm_campaign",
+	"utm_term",
+	"utm_content",
+	"gclid",
+	"gbraid",
+	"wbraid",
+	"fbclid",
+	"msclkid",
+	"ttclid",
+	"ref"
+];
+const hasScheme = (value) => /^[a-z][a-z0-9+.-]*:\/\//i.test(value);
+/**
+* Remove non-allow-listed query params (and always the hash) from `rawUrl`.
+* - Matching is case-insensitive on the param NAME; kept params preserve their
+*   original order, repeats, and values.
+* - Relative URLs are supported (the sentinel base is stripped back off).
+* - Never throws and never returns a broken url: on parse failure it returns the
+*   original string (the server still strips authoritatively).
+*/
+const stripUrl = (rawUrl, allowlist = DEFAULT_QUERY_PARAM_ALLOWLIST) => {
+	if (!rawUrl) return rawUrl;
+	try {
+		const allow = new Set(allowlist.map((name) => name.toLowerCase()));
+		const absolute = hasScheme(rawUrl);
+		const parsed = new URL(rawUrl, absolute ? void 0 : "http://x.invalid");
+		const kept = new URLSearchParams();
+		parsed.searchParams.forEach((value, key) => {
+			if (allow.has(key.toLowerCase())) kept.append(key, value);
+		});
+		const search = kept.toString();
+		const path = `${parsed.pathname}${search ? `?${search}` : ""}`;
+		return absolute ? `${parsed.protocol}//${parsed.host}${path}` : path;
+	} catch (_unused) {
+		return rawUrl;
+	}
+};
+//#endregion
+//#region src/api.ts
+const API_URL = "https://api.leapio.com";
+const deriveEndpoint = (config, suffix) => {
+	if (!config.externalApiUrl) return `${API_URL}/${suffix}`;
+	try {
+		const url = new URL(config.externalApiUrl);
+		if (/\/(i|track)\/?$/.test(url.pathname)) {
+			url.pathname = url.pathname.replace(/\/(i|track)\/?$/, `/${suffix}`);
+			return url.toString();
+		}
+	} catch (_unused) {}
+	console.error(`Leapio - cannot derive the /${suffix} endpoint from externalApiUrl. Set ${suffix === "identify" ? "identifyApiUrl" : "consentApiUrl"} explicitly.`);
+	return null;
+};
+const identifyUrlFromConfig = (config) => {
+	if (config.identifyApiUrl) return config.identifyApiUrl;
+	return deriveEndpoint(config, "identify");
+};
+const consentUrlFromConfig = (config) => {
+	if (config.consentApiUrl) return config.consentApiUrl;
+	return deriveEndpoint(config, "consent");
+};
+const groupUrlFromConfig = (config) => {
+	if (config.groupApiUrl) return config.groupApiUrl;
+	return deriveEndpoint(config, "group");
+};
+/**
+* Apply consent stamps to an event payload. Called *after* the user's
+* `eventMapper` so the stamps are authoritative and never clobbered. When no
+* snapshot exists the stamps default to empty strings ("pre-consent / unknown"),
+* matching the server's legacy-empty handling.
+*/
+const consentStampFields = (snapshot) => snapshot ? {
+	privacy_categories: encodeCategories(snapshot.categories),
+	privacy_signals: encodeSignals(snapshot.signals),
+	consent_source: snapshot.source
+} : {
+	privacy_categories: "",
+	privacy_signals: "",
+	consent_source: null
+};
+const stampConsent = (payload, snapshot) => _objectSpread2(_objectSpread2({}, payload), consentStampFields(snapshot));
+const trackEvent = async (config, payload, consentSnapshot, acOverrides) => {
+	if (!payload.event) {
+		console.error("Leapio - event parameter is required");
+		return;
+	}
+	try {
+		var _payload$userId, _payload$anonymousId, _payload$metadata, _payload$referrer;
+		let payloadToSend = _objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2({
+			name: payload.event,
+			channel: payload.channel,
+			message: payload.message,
+			notify: payload.notify,
+			user_id: (_payload$userId = payload.userId) !== null && _payload$userId !== void 0 ? _payload$userId : null,
+			anonymous_id: (_payload$anonymousId = payload.anonymousId) !== null && _payload$anonymousId !== void 0 ? _payload$anonymousId : null,
+			metadata: (_payload$metadata = payload.metadata) !== null && _payload$metadata !== void 0 ? _payload$metadata : {},
+			hostname: payload.hostname,
+			url: payload.url,
+			referrer: ((_payload$referrer = payload.referrer) === null || _payload$referrer === void 0 ? void 0 : _payload$referrer.length) ? payload.referrer : null,
+			language: payload.language,
+			screen: payload.screen
+		}, payload.value != null ? { value: payload.value } : {}), payload.currency != null ? { currency: payload.currency } : {}), payload.groupId ? { group_id: payload.groupId } : {}), payload.groupId ? { group_type: payload.groupType || "company" } : {});
+		if (config.eventMapper) payloadToSend = await config.eventMapper(payloadToSend);
+		if (config.stripQueryParams) {
+			var _payloadToSend$referr;
+			payloadToSend = _objectSpread2(_objectSpread2({}, payloadToSend), {}, {
+				url: stripUrl(payloadToSend.url, config.queryParamAllowlist),
+				referrer: ((_payloadToSend$referr = payloadToSend.referrer) === null || _payloadToSend$referr === void 0 ? void 0 : _payloadToSend$referr.length) ? stripUrl(payloadToSend.referrer, config.queryParamAllowlist) : null
+			});
+		}
+		if (payloadToSend.referrer && payloadToSend.referrer.length > 255) payloadToSend = _objectSpread2(_objectSpread2({}, payloadToSend), {}, { referrer: payloadToSend.referrer.slice(0, 255) });
+		payloadToSend = stampConsent(payloadToSend, consentSnapshot !== null && consentSnapshot !== void 0 ? consentSnapshot : null);
+		const wireBody = acOverrides ? _objectSpread2(_objectSpread2({}, payloadToSend), {}, { _acOverrides: acOverrides }) : payloadToSend;
+		const response = await fetch(config.externalApiUrl ? config.externalApiUrl : `${API_URL}/i`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				"x-leapio-pk": config.publicKey
+			},
+			mode: "cors",
+			keepalive: true,
+			body: JSON.stringify(wireBody)
+		});
+		if (!response.ok) {
+			console.error("Leapio - track rejected", response.status);
+			return;
+		}
+		await persistConfigFromResponse(config.publicKey, response);
+	} catch (err) {
+		console.error("Leapio - could not track event");
+	}
+};
+/**
+* Read the `config` field from a track response and cache it for the public
+* key. Tolerates non-JSON / missing bodies and never throws — config delivery
+* is additive and must never break tracking.
+*/
+const persistConfigFromResponse = async (publicKey, response) => {
+	if (!publicKey || !response || !response.ok) return;
+	try {
+		const body = await response.json();
+		if (typeof body !== "object" || body === null) return;
+		const config = body.config;
+		if (typeof config === "object" && config !== null) writeRemoteConfig(publicKey, config);
+	} catch (_unused2) {}
+};
+const identifyUser = async (config, payload, consentSnapshot) => {
+	var _payload$traits, _payload$options;
+	if (!payload.userId) {
+		console.error("Leapio - identify requires a userId");
+		return {
+			ok: false,
+			reason: "missing_user_id"
+		};
+	}
+	const body = {
+		anonymous_id: payload.anonymousId,
+		user_id: payload.userId,
+		traits: (_payload$traits = payload.traits) !== null && _payload$traits !== void 0 ? _payload$traits : {},
+		timestamp: (/* @__PURE__ */ new Date()).toISOString()
+	};
+	Object.assign(body, consentStampFields(consentSnapshot !== null && consentSnapshot !== void 0 ? consentSnapshot : null));
+	if ((_payload$options = payload.options) === null || _payload$options === void 0 || (_payload$options = _payload$options.identityVerification) === null || _payload$options === void 0 ? void 0 : _payload$options.token) body.identity_verification = { token: payload.options.identityVerification.token };
+	const endpoint = identifyUrlFromConfig(config);
+	if (!endpoint) return {
+		ok: false,
+		reason: "no_endpoint"
+	};
+	try {
+		const response = await fetch(endpoint, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				"x-leapio-pk": config.publicKey
+			},
+			mode: "cors",
+			keepalive: true,
+			body: JSON.stringify(body)
+		});
+		if (response.ok) return {
+			ok: true,
+			status: response.status
+		};
+		let reason;
+		try {
+			const errorBody = await response.json();
+			reason = typeof (errorBody === null || errorBody === void 0 ? void 0 : errorBody.message) === "string" ? errorBody.message : void 0;
+		} catch (_unused3) {}
+		console.error("Leapio - identify failed", response.status, reason);
+		return {
+			ok: false,
+			status: response.status,
+			reason
+		};
+	} catch (err) {
+		console.error("Leapio - could not identify user");
+		return {
+			ok: false,
+			reason: "network_error"
+		};
+	}
+};
+/**
+* Associate the current user/anonymous visitor with a group (Segment `group()`).
+* Sent with the `x-leapio-pk` header like the other public-API calls. The
+* platform requires a `user_id` or `anonymous_id`; the SDK always supplies its
+* managed `anonymous_id`, and `user_id` when the visitor is identified.
+*/
+const groupUser = async (config, payload) => {
+	var _payload$options2;
+	if (!payload.groupId) {
+		console.error("Leapio - group requires a groupId");
+		return {
+			ok: false,
+			reason: "missing_group_id"
+		};
+	}
+	if (!payload.userId && !payload.anonymousId) {
+		console.error("Leapio - group requires a userId or anonymousId");
+		return {
+			ok: false,
+			reason: "missing_subject"
+		};
+	}
+	const body = {
+		group_id: payload.groupId,
+		type: payload.type || "company",
+		anonymous_id: payload.anonymousId,
+		timestamp: (/* @__PURE__ */ new Date()).toISOString()
+	};
+	if (payload.userId) body.user_id = payload.userId;
+	if (payload.traits) body.traits = payload.traits;
+	if ((_payload$options2 = payload.options) === null || _payload$options2 === void 0 || (_payload$options2 = _payload$options2.identityVerification) === null || _payload$options2 === void 0 ? void 0 : _payload$options2.token) body.identity_verification = { token: payload.options.identityVerification.token };
+	const endpoint = groupUrlFromConfig(config);
+	if (!endpoint) return {
+		ok: false,
+		reason: "no_endpoint"
+	};
+	try {
+		const response = await fetch(endpoint, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				"x-leapio-pk": config.publicKey
+			},
+			mode: "cors",
+			keepalive: true,
+			body: JSON.stringify(body)
+		});
+		if (response.ok) return {
+			ok: true,
+			status: response.status
+		};
+		let reason;
+		try {
+			const errorBody = await response.json();
+			reason = typeof (errorBody === null || errorBody === void 0 ? void 0 : errorBody.message) === "string" ? errorBody.message : void 0;
+		} catch (_unused4) {}
+		console.error("Leapio - group failed", response.status, reason);
+		return {
+			ok: false,
+			status: response.status,
+			reason
+		};
+	} catch (err) {
+		console.error("Leapio - could not associate group");
+		return {
+			ok: false,
+			reason: "network_error"
+		};
+	}
+};
+/**
+* POST the current consent state to the backend `/consent` endpoint.
+*
+* Body shape:
+*   { anonymous_id?, user_id?, analytics?, functional?, marketing?,
+*     doNotSellShare?, gpc?, gppDetected?, gppString?, source, sourceMetadata? }
+*
+* Sent with the `x-leapio-pk` header like the other public-API calls. Only
+* fields that are present in the snapshot are included so the server can tell
+* "not specified" apart from an explicit `false`.
+*/
+const postConsent = async (config, payload) => {
+	var _payload$identityVeri;
+	const { categories, signals, source, sourceMetadata } = payload.snapshot;
+	const body = { source };
+	if (payload.anonymousId) body.anonymous_id = payload.anonymousId;
+	if (payload.userId) body.user_id = payload.userId;
+	if (typeof categories.analytics === "boolean") body.analytics = categories.analytics;
+	if (typeof categories.functional === "boolean") body.functional = categories.functional;
+	if (typeof categories.marketing === "boolean") body.marketing = categories.marketing;
+	if (typeof signals.doNotSellShare === "boolean") body.doNotSellShare = signals.doNotSellShare;
+	if (typeof signals.gpc === "boolean") body.gpc = signals.gpc;
+	if (typeof signals.gppDetected === "boolean") body.gppDetected = signals.gppDetected;
+	if (typeof signals.gppString === "string") body.gppString = signals.gppString;
+	if (sourceMetadata) body.sourceMetadata = sourceMetadata;
+	if ((_payload$identityVeri = payload.identityVerification) === null || _payload$identityVeri === void 0 ? void 0 : _payload$identityVeri.token) body.identity_verification = { token: payload.identityVerification.token };
+	const endpoint = consentUrlFromConfig(config);
+	if (!endpoint) return {
+		ok: false,
+		reason: "no_endpoint"
+	};
+	try {
+		const response = await fetch(endpoint, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				"x-leapio-pk": config.publicKey
+			},
+			mode: "cors",
+			keepalive: true,
+			body: JSON.stringify(body)
+		});
+		if (response.ok) return {
+			ok: true,
+			status: response.status
+		};
+		let reason;
+		try {
+			const errorBody = await response.json();
+			reason = typeof (errorBody === null || errorBody === void 0 ? void 0 : errorBody.message) === "string" ? errorBody.message : void 0;
+		} catch (_unused5) {}
+		console.error("Leapio - consent push failed", response.status, reason);
+		return {
+			ok: false,
+			status: response.status,
+			reason
+		};
+	} catch (err) {
+		console.error("Leapio - could not push consent");
+		return {
+			ok: false,
+			reason: "network_error"
+		};
+	}
+};
+//#endregion
+//#region src/utils.ts
+const removeQueryParamsFromUrl = (url, params) => {
+	try {
+		const hashIndex = url.indexOf("#");
+		const hash = hashIndex >= 0 ? url.slice(hashIndex) : "";
+		const [base, queryString] = (hashIndex >= 0 ? url.slice(0, hashIndex) : url).split("?");
+		if (!queryString) return `${base}${hash}`;
+		const cleaned = Array.from(new URLSearchParams(queryString).entries()).filter(([param]) => !params.includes(param));
+		if (!cleaned.length) return `${base}${hash}`;
+		const queryParams = new URLSearchParams();
+		for (const [param, value] of cleaned) queryParams.append(param, value);
+		return `${base}?${queryParams}${hash}`;
+	} catch (err) {
+		return url;
+	}
+};
+const b64EncodeUnicode = (str) => {
+	return btoa(encodeURIComponent(str));
+};
+const UnicodeDecodeB64 = (str) => {
+	return decodeURIComponent(atob(str));
+};
+//#endregion
+//#region src/campaign.ts
+const CAMPAIGN_KEYWORDS = [
+	"gclid",
+	"fbclid",
+	"msclkid",
+	"utm_source",
+	"utm_id",
+	"utm_medium",
+	"utm_campaign",
+	"utm_content",
+	"utm_term"
+];
+const LINK_TAGS = [...CAMPAIGN_KEYWORDS, "ref"];
+const CAMPAIGN_COOKIE = "leapio_c";
+const LEGACY_CAMPAIGN_COOKIE = "lgspt_c";
+const LEGACY_FIRST_TOUCH_COOKIE = "lgspt_ft";
+const FIRST_TOUCH_COOKIE = "leapio_ft";
+const DEFAULT_EXPIRATION = 604800;
+const FIRST_TOUCH_EXPIRATION = 31536e3;
+var Campaign = class {
+	constructor(sdkConfig) {
+		this.sdkConfig = sdkConfig;
+		const params = this._hasLinkTag() ? this._getParams() : this._getCampaignCookie();
+		if (sdkConfig.stickyCampaigns) this._setCampaignCookie(params);
+		this.campaignParams = params;
+		this._captureFirstTouch();
+	}
+	getCampaignParams() {
+		const params = this._getParams();
+		if (this.sdkConfig.stickyCampaigns && !this._hasLinkTag()) return this.campaignParams;
+		return params;
+	}
+	/**
+	* The durable first-touch params captured on the visitor's first campaign
+	* visit (UTM/click-ids + referrer + landing url). Empty object when no
+	* first-touch has been recorded (pure direct traffic so far). Read-only — the
+	* cookie is never overwritten once set.
+	*/
+	getFirstTouchParams() {
+		return this._getFirstTouchCookie();
+	}
+	_getCampaignCookie() {
+		try {
+			var _getCookie;
+			const cookie = (_getCookie = getCookie(CAMPAIGN_COOKIE)) !== null && _getCookie !== void 0 ? _getCookie : getCookie(LEGACY_CAMPAIGN_COOKIE);
+			return cookie ? JSON.parse(UnicodeDecodeB64(cookie)) : {};
+		} catch (_unused) {
+			return {};
+		}
+	}
+	_setCampaignCookie(campaignParams) {
+		var _this$sdkConfig$stick, _this$sdkConfig$cooki;
+		setCookie({
+			name: CAMPAIGN_COOKIE,
+			value: b64EncodeUnicode(JSON.stringify(campaignParams)),
+			expiresInSeconds: (_this$sdkConfig$stick = this.sdkConfig.stickyCampaignsExpirationInSeconds) !== null && _this$sdkConfig$stick !== void 0 ? _this$sdkConfig$stick : DEFAULT_EXPIRATION,
+			domain: (_this$sdkConfig$cooki = this.sdkConfig.cookieDomain) !== null && _this$sdkConfig$cooki !== void 0 ? _this$sdkConfig$cooki : null
+		});
+	}
+	_hasLinkTag() {
+		const query = new URLSearchParams(window.location.search);
+		return LINK_TAGS.some((key) => Boolean(query.get(key)));
+	}
+	_getParams() {
+		const urlSearchParams = new URLSearchParams(window.location.search);
+		const queryParams = Object.fromEntries(urlSearchParams.entries());
+		return CAMPAIGN_KEYWORDS.reduce((acc, next) => {
+			var _queryParams$next;
+			if ((_queryParams$next = queryParams[next]) === null || _queryParams$next === void 0 ? void 0 : _queryParams$next.length) return _objectSpread2(_objectSpread2({}, acc), {}, { [next]: queryParams[next] });
+			return acc;
+		}, {});
+	}
+	_getFirstTouchCookie() {
+		try {
+			var _getCookie2;
+			const cookie = (_getCookie2 = getCookie(FIRST_TOUCH_COOKIE)) !== null && _getCookie2 !== void 0 ? _getCookie2 : getCookie(LEGACY_FIRST_TOUCH_COOKIE);
+			return cookie ? JSON.parse(UnicodeDecodeB64(cookie)) : {};
+		} catch (_unused2) {
+			return {};
+		}
+	}
+	/**
+	* Persist the first-touch snapshot exactly once. A first-touch is recorded
+	* only when the visit carries a campaign signal (any UTM/click-id) or a
+	* referrer — pure direct first visits do not lock in an empty first-touch, so
+	* a later campaign visit can still become the first-touch.
+	*/
+	_captureFirstTouch() {
+		var _this$sdkConfig$cooki2;
+		const existing = this._getFirstTouchCookie();
+		if (Object.keys(existing).length > 0) return;
+		const params = this._getParams();
+		const rawReferrer = typeof document !== "undefined" ? document.referrer || "" : "";
+		const referrer = this._isExternalReferrer(rawReferrer) ? rawReferrer : "";
+		const landingUrl = typeof window !== "undefined" && window.location ? window.location.href : "";
+		const hasCampaignSignal = Object.keys(params).length > 0;
+		const hasReferrer = referrer.length > 0;
+		if (!hasCampaignSignal && !hasReferrer) return;
+		const firstTouch = _objectSpread2({}, params);
+		if (hasReferrer) firstTouch.referrer = referrer;
+		if (landingUrl) firstTouch.landing_url = landingUrl;
+		setCookie({
+			name: FIRST_TOUCH_COOKIE,
+			value: b64EncodeUnicode(JSON.stringify(firstTouch)),
+			expiresInSeconds: FIRST_TOUCH_EXPIRATION,
+			domain: (_this$sdkConfig$cooki2 = this.sdkConfig.cookieDomain) !== null && _this$sdkConfig$cooki2 !== void 0 ? _this$sdkConfig$cooki2 : null
+		});
+	}
+	_isExternalReferrer(referrer) {
+		if (!referrer) return false;
+		try {
+			return new URL(referrer).host !== window.location.host;
+		} catch (_unused3) {
+			return true;
+		}
+	}
+};
+//#endregion
+//#region src/class-listener.ts
+const LEGACY_CLASS_PREFIX = "lgspt-";
+/**
+* Attach the always-on `lgspt-` classname click listener. Returns a teardown
+* that removes the listener (invoked on `reset()`); the listener semantics are
+* otherwise unchanged from the historical always-on behavior.
+*/
+const listenToClassClicks = (trackClick) => {
+	const onClick = (event) => {
+		const target = event.target;
+		if (new RegExp(LEGACY_CLASS_PREFIX).test(target.className) === false) return;
+		const classList = target.className.split(" ").filter((className) => className.startsWith(LEGACY_CLASS_PREFIX));
+		if (classList.length === 0) return;
+		trackClick({ name: classList[0].replace(LEGACY_CLASS_PREFIX, "").split("-").map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ") });
+	};
+	document.addEventListener("click", onClick);
+	return () => document.removeEventListener("click", onClick);
+};
+//#endregion
+//#region src/consent-sources/listen.ts
+const listenToWindowEvents = (events, onEvent) => {
+	const attached = [];
+	for (const eventName of events) try {
+		window.addEventListener(eventName, onEvent);
+		attached.push(() => window.removeEventListener(eventName, onEvent));
+	} catch (_unused) {}
+	return () => {
+		for (const off of attached) try {
+			off();
+		} catch (_unused2) {}
+	};
+};
+//#endregion
+//#region src/consent-sources/concord.ts
+/**
+* Concord CMP adapter (concord.tech). Read-only. Sits high on the source
+* ladder (`concord`, just below the explicit API).
+*
+* Contract per the public docs:
+* https://www.concord.tech/docs/manually-blocking-trackers-before-consent
+*
+*   window.concord.consent.hasConsent(category: string): boolean
+*     — reads `store.consentState.allowState[category] === true`. Definitive
+*       under Concord's enforcement model: `false` means "not granted (yet)",
+*       which is exactly what Concord itself uses to gate trackers, so we
+*       mirror it verbatim.
+*   window.concord.consent.hasDoNotSell(): boolean
+*     — `allowState.do_not_sell === true`. The adapter reports this signal
+*       FAITHFULLY whenever it is active — signals and categories are
+*       independent facts and the adapter is a reader, not an interpreter.
+*       SEMANTICS NOTE: `marketing: true` +
+*       `do_not_sell: true` almost always means DNS/GPC was detected and
+*       auto-declined marketing, and the user then manually flipped
+*       marketing back on. Either way the CMP result is trusted AS-IS — how
+*       marketing got to true is Concord's business. The resolution happens
+*       DOWNSTREAM in Leapio's export evaluation (a source-reported
+*       `marketing: true` in current consent overrides `doNotSellShare`;
+*       DNS wins only when no source ever spoke for marketing), so both
+*       facts must arrive intact.
+*   window.concord.consent.hasGPC(): boolean
+*     — true when the `global_privacy_control` consent record is accepted
+*       (i.e. Concord detected and applied GPC). Feeds Leapio's `gpc`
+*       signal.
+*   window.concord.consent.isDefaults: boolean (proxy getter)
+*     — true while the state is region-template defaults (no real user
+*       decision yet). Recorded as sourceMetadata so Leapio can tell
+*       default-derived consent from an actual user decision.
+*   window.concord.consent.onConsent(category, cb)
+*     — one-shot grant hook; we rely on the window events below instead,
+*       which also cover revocations.
+*
+*   Window events:
+*     concord-ready                  — fully initialized
+*     concord-consent-state-loading  — fetching consent state (reads unsafe)
+*     concord-consent-state-loaded   — consent state retrieved
+*     concord-consent-state-changed  — user updated preferences
+*     concord-unavailable            — Concord aborted (it also sets
+*                                      window.concord = undefined)
+*
+* Category mapping is IDENTITY: Concord's canonical categories are already
+* `analytics` / `functional` / `marketing` — `hasConsent` is called with our
+* category names directly.
+*
+* The signal helpers (`hasDoNotSell`/`hasGPC`) and `isDefaults` are guarded as
+* optional — older Concord builds that only ship `hasConsent` still work,
+* they just emit categories only.
+*/
+const SOURCE_NAME$4 = "concord";
+const PRIORITY$4 = 80;
+const CATEGORIES = [
+	"analytics",
+	"functional",
+	"marketing"
+];
+const getConcordConsentApi = () => {
+	try {
+		var _win$concord;
+		const consent = (_win$concord = window.concord) === null || _win$concord === void 0 ? void 0 : _win$concord.consent;
+		if (consent && typeof consent === "object" && typeof consent.hasConsent === "function") return consent;
+		return null;
+	} catch (_unused) {
+		return null;
+	}
+};
+const STATE_READY_EVENTS = [
+	"concord-ready",
+	"concord-consent-state-loaded",
+	"concord-consent-state-changed"
+];
+/**
+* Construct the Concord CMP source. `read()` yields `null` until
+* `window.concord.consent` is present (and not mid-load / aborted — see the
+* loading/unavailable guards, which only engage once `subscribe()` has
+* observed the corresponding events).
+*/
+const createConcordSource = () => {
+	let stateLoading = false;
+	let unavailable = false;
+	return {
+		name: SOURCE_NAME$4,
+		priority: PRIORITY$4,
+		read() {
+			try {
+				if (unavailable || stateLoading) return null;
+				const api = getConcordConsentApi();
+				if (!api) return null;
+				const categories = {};
+				for (const category of CATEGORIES) categories[category] = api.hasConsent(category) === true;
+				const signals = {};
+				const sourceMetadata = {};
+				if (typeof api.hasDoNotSell === "function" && api.hasDoNotSell()) signals.doNotSellShare = true;
+				if (typeof api.hasGPC === "function" && api.hasGPC() === true) signals.gpc = true;
+				if (typeof api.isDefaults === "boolean") sourceMetadata.isDefaults = api.isDefaults;
+				const snapshot = {
+					categories,
+					signals,
+					source: SOURCE_NAME$4,
+					updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+				};
+				if (Object.keys(sourceMetadata).length > 0) snapshot.sourceMetadata = sourceMetadata;
+				return snapshot;
+			} catch (_unused2) {
+				return null;
+			}
+		},
+		subscribe(cb) {
+			const notify = () => {
+				try {
+					cb();
+				} catch (_unused3) {}
+			};
+			const offReady = listenToWindowEvents(STATE_READY_EVENTS, () => {
+				stateLoading = false;
+				unavailable = false;
+				notify();
+			});
+			const offLoading = listenToWindowEvents(["concord-consent-state-loading"], () => {
+				stateLoading = true;
+			});
+			const offUnavailable = listenToWindowEvents(["concord-unavailable"], () => {
+				unavailable = true;
+			});
+			return () => {
+				offReady();
+				offLoading();
+				offUnavailable();
+			};
+		}
+	};
+};
+//#endregion
+//#region src/consent-sources/gcm-reader.ts
+/**
+* Google Consent Mode v2 READER.
+*
+* Strictly read-only: this source reads the current Google Consent Mode state
+* that some *other* tool on the page (a CMP, gtag bootstrap, GTM) has set, and
+* maps it onto Leapio's categories. It NEVER calls `gtag('consent', ...)` or
+* mutates Google state in any way — Leapio is a consumer of consent, never a
+* writer into Google.
+*
+* ## Where the state is read from
+*
+* gtag's bootstrap is `function gtag(){dataLayer.push(arguments)}`, so every
+* `gtag('consent','default'|'update', {...})` pushes the function's *arguments*
+* object (array-like: `entry[0]='consent'`, `entry[1]='default'|'update'`,
+* `entry[2]={signal:'granted'|'denied', ...}`) onto `window.dataLayer`. We scan
+* `dataLayer` in order and fold every consent entry into a per-signal map; later
+* entries win, so an `update` issued after the user chooses supersedes the
+* initial `default` (Google docs: "effective state = update when present, else
+* default").
+*   Source: https://developers.google.com/tag-platform/security/guides/consent
+*
+* As a best-effort *fallback* (when no scannable dataLayer entries exist, e.g. a
+* CMP registered the default internally), we read the internal consent state at
+* `window.google_tag_data.ics`. That object is INTERNAL/UNDOCUMENTED (it does
+* not appear in any developers.google.com page) and may break across gtag.js
+* releases, so it is only consulted when the documented dataLayer scan yields
+* nothing.
+*   Source (non-authoritative, flagged): https://gunnargriese.com/posts/consent-mode-v2/
+*
+* ## Mapping
+*
+*   analytics_storage                              -> analytics
+*   functionality_storage + personalization_storage -> functional  (AND)
+*   ad_storage + ad_user_data + ad_personalization -> marketing     (AND)
+*
+* ### Why AND across the functional/marketing groups
+*
+* Multiple GCM signals map onto a single Leapio category. GCM signals
+* are independently grantable, so a group can be split (e.g. `ad_storage`
+* granted but `ad_personalization` denied). Leapio categories gate downstream
+* *use* — granting `marketing` authorizes advertising use of the data. We choose
+* the CONSERVATIVE / least-privilege reading: a Leapio category is granted only
+* when EVERY GCM signal that maps to it is `granted`. If any contributing signal
+* is denied, the category is denied. This guarantees we never over-permit
+* marketing/functional use relative to what the user told Google. Verified
+* against Google's GCM v2 semantics (each signal carries an independent
+* granted/denied value; there is no documented roll-up), so the AND choice is a
+* deliberate policy decision, not an inference about Google's own roll-up.
+*
+* A signal that is *absent entirely* (never set) is treated as "unknown" and
+* does not by itself deny the category — only an explicit `denied` denies. A
+* category is reported only when at least one of its contributing signals has an
+* explicit value; categories with no information stay absent from the snapshot
+* (so they fall through to the org's `consentBehavior` server-side, exactly like
+* any other source that "never spoke" about a category).
+*/
+const SOURCE_NAME$3 = "gcm";
+const PRIORITY$3 = 40;
+/** The GCM signals each Leapio category is composed from (conservative AND). */
+const CATEGORY_SIGNALS = {
+	analytics: ["analytics_storage"],
+	functional: ["functionality_storage", "personalization_storage"],
+	marketing: [
+		"ad_storage",
+		"ad_user_data",
+		"ad_personalization"
+	]
+};
+const ALL_SIGNALS = [
+	"analytics_storage",
+	"functionality_storage",
+	"personalization_storage",
+	"ad_storage",
+	"ad_user_data",
+	"ad_personalization"
+];
+const isGcmValue = (value) => value === "granted" || value === "denied";
+/**
+* Fold the `window.dataLayer` consent entries into a per-signal value map.
+* Scans in push order so later (`update`) entries override earlier (`default`)
+* ones on a per-signal basis. Region scoping is ignored in V1: every matching
+* `default`/`update` is applied in order, so the last writer for each signal
+* wins (a documented simplification — region-specific defaults exist but are not
+* resolved here). Returns `null` when no consent entries are present.
+*/
+const readFromDataLayer = () => {
+	let dataLayer;
+	try {
+		dataLayer = window.dataLayer;
+	} catch (_unused) {
+		return null;
+	}
+	if (!Array.isArray(dataLayer)) return null;
+	const signals = {};
+	let sawConsentEntry = false;
+	for (const entry of dataLayer) {
+		if (!entry || typeof entry !== "object") continue;
+		const arrayLike = entry;
+		if (typeof arrayLike.length !== "number" || arrayLike.length < 3) continue;
+		if (arrayLike[0] !== "consent") continue;
+		const mode = arrayLike[1];
+		if (mode !== "default" && mode !== "update") continue;
+		const params = arrayLike[2];
+		if (!params || typeof params !== "object") continue;
+		sawConsentEntry = true;
+		for (const signal of ALL_SIGNALS) {
+			const value = params[signal];
+			if (isGcmValue(value)) signals[signal] = value;
+		}
+	}
+	return sawConsentEntry ? signals : null;
+};
+/**
+* Best-effort fallback: read the internal consent state at
+* `window.google_tag_data.ics`. INTERNAL/UNDOCUMENTED — only consulted when the
+* documented dataLayer scan yields nothing. The `ics.entries` map is keyed by
+* signal; each entry exposes `update`/`default` (update supersedes) and/or a
+* `getConsentState(signal)` returning `1` (granted) / `0` (denied). We read
+* conservatively and tolerate any shape mismatch.
+*/
+const readFromInternalState = () => {
+	let ics;
+	try {
+		var _google_tag_data;
+		ics = (_google_tag_data = window.google_tag_data) === null || _google_tag_data === void 0 ? void 0 : _google_tag_data.ics;
+	} catch (_unused2) {
+		return null;
+	}
+	if (!ics || typeof ics !== "object") return null;
+	const signals = {};
+	let sawAny = false;
+	const entries = ics.entries;
+	if (entries && typeof entries === "object") for (const signal of ALL_SIGNALS) {
+		const entry = entries[signal];
+		if (!entry || typeof entry !== "object") continue;
+		const record = entry;
+		const raw = record.update !== void 0 ? record.update : record.default;
+		if (raw === true) {
+			signals[signal] = "granted";
+			sawAny = true;
+		} else if (raw === false) {
+			signals[signal] = "denied";
+			sawAny = true;
+		} else if (isGcmValue(raw)) {
+			signals[signal] = raw;
+			sawAny = true;
+		}
+	}
+	return sawAny ? signals : null;
+};
+/**
+* Compute one Leapio category from its GCM signals (conservative AND):
+*  - `false` if ANY contributing signal is explicitly `denied`,
+*  - `true` if ALL contributing signals are explicitly `granted`,
+*  - `undefined` (category omitted) if no contributing signal has a value.
+*/
+const resolveCategory = (category, signals) => {
+	const contributing = CATEGORY_SIGNALS[category];
+	let sawAny = false;
+	let allGranted = true;
+	for (const signal of contributing) {
+		const value = signals[signal];
+		if (value === void 0) {
+			allGranted = false;
+			continue;
+		}
+		sawAny = true;
+		if (value === "denied") return false;
+	}
+	if (!sawAny || !allGranted) return void 0;
+	return true;
+};
+const buildSnapshot$2 = (signals) => {
+	const categories = {};
+	let sawAny = false;
+	Object.keys(CATEGORY_SIGNALS).forEach((category) => {
+		const resolved = resolveCategory(category, signals);
+		if (resolved !== void 0) {
+			categories[category] = resolved;
+			sawAny = true;
+		}
+	});
+	if (!sawAny) return null;
+	return {
+		categories,
+		signals: {},
+		source: SOURCE_NAME$3,
+		updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		sourceMetadata: { gcm: signals }
+	};
+};
+/** Read the current GCM state: documented dataLayer scan, then internal fallback. */
+const readGcmState = () => {
+	var _readFromDataLayer;
+	return (_readFromDataLayer = readFromDataLayer()) !== null && _readFromDataLayer !== void 0 ? _readFromDataLayer : readFromInternalState();
+};
+/**
+* Construct the Google Consent Mode reader source. Always returns a source; its
+* `read()` yields `null` until consent entries are observable (so the registry
+* keeps it registered and re-reads on subscribe callbacks safely even when GCM
+* is not yet present).
+*/
+const createGcmReaderSource = () => {
+	return {
+		name: SOURCE_NAME$3,
+		priority: PRIORITY$3,
+		read() {
+			try {
+				const signals = readGcmState();
+				if (!signals) return null;
+				return buildSnapshot$2(signals);
+			} catch (_unused3) {
+				return null;
+			}
+		},
+		subscribe(cb) {
+			let dataLayer;
+			try {
+				const win = window;
+				if (!Array.isArray(win.dataLayer)) {
+					var _win$dataLayer;
+					win.dataLayer = (_win$dataLayer = win.dataLayer) !== null && _win$dataLayer !== void 0 ? _win$dataLayer : [];
+				}
+				dataLayer = win.dataLayer;
+			} catch (_unused4) {
+				return () => {};
+			}
+			if (!Array.isArray(dataLayer)) return () => {};
+			const arr = dataLayer;
+			const originalPush = arr.push;
+			const wrapped = (...items) => {
+				const result = originalPush.apply(arr, items);
+				for (const item of items) {
+					const arrayLike = item;
+					if (arrayLike && typeof arrayLike === "object" && arrayLike[0] === "consent") {
+						try {
+							cb();
+						} catch (_unused5) {}
+						break;
+					}
+				}
+				return result;
+			};
+			try {
+				arr.push = wrapped;
+			} catch (_unused6) {
+				return () => {};
+			}
+			return () => {
+				try {
+					if (arr.push === wrapped) arr.push = originalPush;
+				} catch (_unused7) {}
+			};
+		}
+	};
+};
+//#endregion
+//#region src/consent-sources/onetrust.ts
+/**
+* OneTrust Cookie Consent adapter. Read-only.
+*
+* ## API surface (verified against OneTrust developer docs)
+*
+* - `window.OnetrustActiveGroups` — a comma-DELIMITED string of the currently
+*   active category group IDs, with LEADING and TRAILING commas, e.g.
+*   `,C0001,C0002,C0004,`. The bounding commas exist precisely so callers can
+*   test membership with `.indexOf(',C0002,')` without `C0002` false-matching
+*   `C0012`.
+*     Source: https://developer.onetrust.com/onetrust/docs/google-tag-manager
+*     Source: https://my.onetrust.com/s/article/UUID-66bcaaf1-c7ca-5f32-6760-c75a1337c226
+*
+* - `OneTrustGroupsUpdated` window event — dispatched both on initial script
+*   load AND whenever the user updates consent; `event.detail` is an array of
+*   active group IDs (e.g. `["C0001","C0002"]`). This is the cleanest change
+*   hook (no string parsing, no load-order dependency), so we subscribe to it.
+*     Source: https://developer.onetrust.com/onetrust/docs/javascript-events-guide
+*
+* - `window.OneTrust.OnConsentChanged(cb)` — a zero-argument change callback;
+*   used as a fallback subscription when the window event is unavailable. Inside
+*   it we re-read `OnetrustActiveGroups`.
+*     Source: https://developer.onetrust.com/onetrust/docs/javascript-api
+*
+* - `OneTrust.IsAlertBoxClosed()`: true when the OptanonAlertBoxClosed cookie is set and consent is valid; that cookie is written on Accept All, Reject All, Close (banner), and Save Settings. Sources: https://developer.onetrust.com/onetrust/docs/javascript-api and https://my.onetrust.com/s/article/UUID-2dc719a8-4be5-8d16-1dc8-c7b4147b88e0
+*
+* ## Category mapping (OneTrust default group IDs -> Leapio categories)
+*
+*   C0001 Strictly Necessary  -> (no Leapio category; always-on, not mapped)
+*   C0002 Performance         -> analytics    // OneTrust's own GCM example maps C0002 -> analytics_storage
+*   C0003 Functional          -> functional
+*   C0004 Targeting           -> marketing    // OneTrust maps C0004 -> ad_storage/ad_* in its GCM example
+*   C0005 Social Media        -> marketing    // social media = cross-site advertising/profiling
+*     Source (defaults + GCM mapping precedent): https://developer.onetrust.com/onetrust/docs/javascript-api
+*
+* CAVEAT: C0001–C0005 are OneTrust's OUT-OF-THE-BOX defaults and are
+* tenant-CUSTOMIZABLE (group IDs and even category labels can be changed per
+* tenant). We map the standard defaults; tenants using custom group IDs would
+* need a configurable mapping (a documented V1 limitation). Unknown/custom group
+* IDs are simply ignored (they grant no Leapio category).
+*
+* We report a category as `true` when its mapped group is active. We do NOT emit
+* `false` for inactive groups: OneTrust's active-groups string lists only what
+* is *granted*, and after a consent decision a group's absence means denied —
+* but on first load (opt-in model) only C0001 is present and the rest are
+* "pending". To stay conservative and avoid asserting a denial the user has not
+* made, an absent mapped group leaves that category UNSET (falls through to the
+* org's consentBehavior server-side). Once at least one non-necessary group is
+* active we treat absent mapped groups as explicit denials, since that indicates
+* the banner has been resolved. When only necessary groups are active, `IsAlertBoxClosed()` (with the OptanonAlertBoxClosed cookie as fallback when the API object is absent) disambiguates:
+* true means the banner was resolved (Reject All / dismissed), so we emit an all-false denial snapshot; false or absent keeps the null pre-decision fallthrough.
+*/
+const SOURCE_NAME$2 = "onetrust";
+const PRIORITY$2 = 60;
+/** Default OneTrust group ID -> Leapio category. C0001 (necessary) is unmapped. */
+const GROUP_TO_CATEGORY = {
+	C0002: "analytics",
+	C0003: "functional",
+	C0004: "marketing",
+	C0005: "marketing"
+};
+const getActiveGroupsString = () => {
+	try {
+		const value = window.OnetrustActiveGroups;
+		return typeof value === "string" ? value : null;
+	} catch (_unused) {
+		return null;
+	}
+};
+const getOneTrust = () => {
+	try {
+		const ot = window.OneTrust;
+		return ot && typeof ot === "object" ? ot : null;
+	} catch (_unused2) {
+		return null;
+	}
+};
+const isAlertBoxClosed = () => {
+	try {
+		const ot = getOneTrust();
+		if (ot && typeof ot.IsAlertBoxClosed === "function") return ot.IsAlertBoxClosed() === true;
+	} catch (_unused3) {
+		return false;
+	}
+	try {
+		return document.cookie.indexOf("OptanonAlertBoxClosed=") !== -1;
+	} catch (_unused4) {
+		return false;
+	}
+};
+/** Parse the comma-bounded active-groups string into a Set of group IDs. */
+const parseActiveGroups = (raw) => {
+	return new Set(raw.split(",").map((id) => id.trim()).filter((id) => id.length > 0));
+};
+const buildSnapshot$1 = (raw) => {
+	const active = parseActiveGroups(raw);
+	let anyNonNecessaryActive = false;
+	let anyNonNecessaryActiveRaw = false;
+	active.forEach((id) => {
+		if (id !== "C0001") {
+			anyNonNecessaryActiveRaw = true;
+			if (GROUP_TO_CATEGORY[id]) anyNonNecessaryActive = true;
+		}
+	});
+	const categories = {};
+	for (const [groupId, category] of Object.entries(GROUP_TO_CATEGORY)) if (active.has(groupId)) categories[category] = true;
+	else if (anyNonNecessaryActive && categories[category] !== true) categories[category] = false;
+	if (Object.keys(categories).length === 0) {
+		if (!isAlertBoxClosed()) return null;
+		if (anyNonNecessaryActiveRaw) return null;
+		return {
+			categories: {
+				analytics: false,
+				functional: false,
+				marketing: false
+			},
+			signals: {},
+			source: SOURCE_NAME$2,
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			sourceMetadata: {
+				activeGroups: Array.from(active),
+				alertBoxClosed: true
+			}
+		};
+	}
+	return {
+		categories,
+		signals: {},
+		source: SOURCE_NAME$2,
+		updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		sourceMetadata: { activeGroups: Array.from(active) }
+	};
+};
+/**
+* Construct the OneTrust source. Always returns a source; `read()` yields `null`
+* until `OnetrustActiveGroups` is present, so the registry registers it safely
+* even before the OneTrust script loads.
+*/
+const createOneTrustSource = () => {
+	return {
+		name: SOURCE_NAME$2,
+		priority: PRIORITY$2,
+		read() {
+			try {
+				const raw = getActiveGroupsString();
+				if (raw === null) return null;
+				return buildSnapshot$1(raw);
+			} catch (_unused5) {
+				return null;
+			}
+		},
+		subscribe(cb) {
+			const notify = () => {
+				try {
+					cb();
+				} catch (_unused6) {}
+			};
+			const off = listenToWindowEvents(["OneTrustGroupsUpdated"], notify);
+			try {
+				const ot = getOneTrust();
+				if (ot && typeof ot.OnConsentChanged === "function") ot.OnConsentChanged(notify);
+			} catch (_unused7) {}
+			return off;
+		}
+	};
+};
+//#endregion
+//#region src/consent-sources/usercentrics.ts
+/**
+* Usercentrics adapter. Read-only.
+*
+* ## API surface (verified against Usercentrics docs)
+*
+* Usercentrics has TWO browser API generations and we support both:
+*
+* - V2 (hosted "UC_UI" CMP): dispatches the `ucEvent` window event. Its
+*   `e.detail.event === 'consent_status'` payload carries a per-category rollup
+*   object `e.detail.ucCategory`, where each category slug maps to
+*   `true` (all services consented) / `false` (all denied) / `null` (mixed).
+*   Init is signalled by `UC_UI_INITIALIZED`.
+*     Source: https://usercentrics.com/docs/web/features/v2/events_v2/events_v2/
+*     Source: https://usercentrics.com/docs/web/features/events/consent-events/
+*
+* - V3 (latest "Web CMP", `window.__ucCmp`): dispatches the `UC_CONSENT` window
+*   event whose `e.detail` is a `ConsentDetails` object. `detail.categories` is a
+*   record keyed by category id; each value has a `state` of
+*   `'ALL_DENIED' | 'SOME_ACCEPTED' | 'ALL_ACCEPTED'`. `window.__ucCmp` also
+*   exposes `getConsentDetails(): Promise<ConsentDetails>` (async — not used in
+*   the synchronous `read()`; we rely on the cached event detail instead).
+*     Source: https://usercentrics.com/docs/web/features/api/control-functionality/
+*     Source: https://usercentrics.com/docs/web/features/api/interfaces/
+*
+* Because `read()` must be synchronous and the hosted CMP has no synchronous
+* category getter, this adapter CACHES the most recent consent state seen on the
+* `ucEvent` / `UC_CONSENT` events (and on any pre-existing `window.__ucCmp`
+* detail captured at construction) and serves `read()` from that cache.
+*
+* ## Category mapping (Usercentrics slugs -> Leapio)
+*
+* Usercentrics categories are CONFIGURABLE per account, so there is no fixed
+* enum. The slugs guaranteed by Usercentrics' own examples are `essential`,
+* `functional`, `marketing` (+ `payment`, essential). We map by slug, matching
+* common conventions case-insensitively:
+*
+*   essential / necessary           -> (unmapped; always-on)
+*   functional / preferences        -> functional
+*   marketing / advertising         -> marketing
+*   analytics / statistics / performance -> analytics
+*
+* CAVEAT: because categories are account-configurable, a tenant may use a slug
+* we don't recognize (it is then ignored — granted nothing). This is a
+* documented V1 limitation; a configurable mapping would be a follow-up.
+*
+* A category rollup of `null` (V2 "mixed") or `'SOME_ACCEPTED'` (V3) is treated
+* conservatively as NOT granted (we only grant on a definitive all-accepted).
+*/
+const SOURCE_NAME$1 = "usercentrics";
+const PRIORITY$1 = 60;
+/** Normalized slug -> Leapio category. Keys are compared lower-cased. */
+const SLUG_TO_CATEGORY = {
+	functional: "functional",
+	preferences: "functional",
+	marketing: "marketing",
+	advertising: "marketing",
+	analytics: "analytics",
+	statistics: "analytics",
+	performance: "analytics"
+};
+const mapSlug = (slug) => {
+	return SLUG_TO_CATEGORY[slug.trim().toLowerCase()];
+};
+/**
+* Fold a per-slug grant map into Leapio categories. When multiple slugs map to
+* the same Leapio category (e.g. analytics + statistics), a grant wins over a
+* denial (most-permissive within a single mapped category), but an explicit
+* denial still records `false` if no mapped slug granted it.
+*/
+const foldSlugGrants = (slugGrants) => {
+	const categories = {};
+	for (const { slug, granted } of slugGrants) {
+		const category = mapSlug(slug);
+		if (!category) continue;
+		if (granted === true) categories[category] = true;
+		else if (categories[category] !== true) categories[category] = false;
+	}
+	return categories;
+};
+/** Parse a V2 `ucEvent` detail (`ucCategory` rollup object). */
+const parseV2Detail = (detail) => {
+	if (!detail || typeof detail !== "object") return null;
+	const d = detail;
+	if (d.event !== "consent_status") return null;
+	const ucCategory = d.ucCategory;
+	if (!ucCategory || typeof ucCategory !== "object") return null;
+	const slugGrants = Object.entries(ucCategory).map(([slug, value]) => ({
+		slug,
+		granted: value === true ? true : value === false ? false : null
+	}));
+	const categories = foldSlugGrants(slugGrants);
+	return Object.keys(categories).length > 0 ? categories : null;
+};
+/** Parse a V3 `UC_CONSENT` detail (`ConsentDetails.categories`). */
+const parseV3Detail = (detail) => {
+	if (!detail || typeof detail !== "object") return null;
+	const categoriesRecord = detail.categories;
+	if (!categoriesRecord || typeof categoriesRecord !== "object") return null;
+	const slugGrants = Object.entries(categoriesRecord).map(([slug, value]) => {
+		const state = value && typeof value === "object" ? value.state : void 0;
+		return {
+			slug,
+			granted: state === "ALL_ACCEPTED" ? true : state === "ALL_DENIED" ? false : null
+		};
+	});
+	const categories = foldSlugGrants(slugGrants);
+	return Object.keys(categories).length > 0 ? categories : null;
+};
+const parseAnyDetail = (detail) => {
+	var _parseV3Detail;
+	return (_parseV3Detail = parseV3Detail(detail)) !== null && _parseV3Detail !== void 0 ? _parseV3Detail : parseV2Detail(detail);
+};
+/**
+* Construct the Usercentrics source. Caches the latest consent state from the
+* vendor's events; `read()` returns `null` until a consent event has been seen.
+*/
+const createUsercentricsSource = () => {
+	let cached = null;
+	return {
+		name: SOURCE_NAME$1,
+		priority: PRIORITY$1,
+		read() {
+			try {
+				if (!cached || Object.keys(cached).length === 0) return null;
+				return {
+					categories: _objectSpread2({}, cached),
+					signals: {},
+					source: SOURCE_NAME$1,
+					updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+				};
+			} catch (_unused) {
+				return null;
+			}
+		},
+		subscribe(cb) {
+			const onDetail = (detail) => {
+				const parsed = parseAnyDetail(detail);
+				if (parsed) {
+					cached = parsed;
+					try {
+						cb();
+					} catch (_unused2) {}
+				}
+			};
+			return listenToWindowEvents(["ucEvent", "UC_CONSENT"], (event) => {
+				onDetail(event.detail);
+			});
+		}
+	};
+};
+//#endregion
+//#region src/consent-sources/cookiebot.ts
+/**
+* Cookiebot adapter. Read-only.
+*
+* ## API surface (verified against the Cookiebot developer reference)
+*   Source: https://www.cookiebot.com/en/developer/
+*
+* - `window.Cookiebot.consent` — read-only booleans for Cookiebot's four fixed
+*   categories: `necessary`, `preferences`, `statistics`, `marketing`. These are
+*   a fixed enum (unlike Usercentrics' configurable categories).
+* - `window.Cookiebot.hasResponse` — `true` once the user has responded (accept
+*   or decline). Used to distinguish "no decision yet" (all booleans default
+*   false / necessary true) from "explicitly all-denied".
+* - `window.Cookiebot.consent.method` — `'implied' | 'explicit'` (or null).
+* - Events (all dispatched on `window`):
+*     `CookiebotOnConsentReady` — fires when consent is ready, whether freshly
+*        submitted OR loaded from an existing cookie (read-on-load + every
+*        change). This is the primary subscription.
+*     `CookiebotOnAccept` / `CookiebotOnDecline` — explicit user actions (also
+*        re-fire for returning consented users); subscribed as a backstop.
+*
+* ## Category mapping (Cookiebot -> Leapio)
+*
+*   necessary   -> (always-on; not mapped to a Leapio category)
+*   preferences -> functional   // "remember user choices (language, region...)"
+*   statistics  -> analytics    // "anonymous analytics / how visitors use the site"
+*   marketing   -> marketing    // "tracking for ads / cross-site profiling"
+*
+* We map each Cookiebot boolean directly. Because Cookiebot exposes explicit
+* booleans (not just a granted-list), we emit `true`/`false` faithfully — but
+* only once `hasResponse` is true. Before a response, `read()` returns `null`
+* so the snapshot falls through to the org's consentBehavior server-side rather
+* than asserting denials the user has not made.
+*/
+const SOURCE_NAME = "cookiebot";
+const PRIORITY = 60;
+/** Cookiebot category -> Leapio category (necessary is intentionally unmapped). */
+const CONSENT_FIELD_TO_CATEGORY = [
+	{
+		field: "preferences",
+		category: "functional"
+	},
+	{
+		field: "statistics",
+		category: "analytics"
+	},
+	{
+		field: "marketing",
+		category: "marketing"
+	}
+];
+const getCookiebot = () => {
+	try {
+		const cb = window.Cookiebot;
+		return cb && typeof cb === "object" ? cb : null;
+	} catch (_unused) {
+		return null;
+	}
+};
+const buildSnapshot = (cb) => {
+	const consent = cb.consent;
+	if (!consent || typeof consent !== "object") return null;
+	if (cb.hasResponse !== true) return null;
+	const categories = {};
+	for (const { field, category } of CONSENT_FIELD_TO_CATEGORY) {
+		const value = consent[field];
+		if (typeof value === "boolean") categories[category] = value;
+	}
+	if (Object.keys(categories).length === 0) return null;
+	return {
+		categories,
+		signals: {},
+		source: SOURCE_NAME,
+		updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		sourceMetadata: { method: typeof consent.method === "string" ? consent.method : void 0 }
+	};
+};
+/**
+* Construct the Cookiebot source. Always returns a source; `read()` yields
+* `null` until `window.Cookiebot` exists and the user has responded.
+*/
+const createCookiebotSource = () => {
+	return {
+		name: SOURCE_NAME,
+		priority: PRIORITY,
+		read() {
+			try {
+				const cb = getCookiebot();
+				if (!cb) return null;
+				return buildSnapshot(cb);
+			} catch (_unused2) {
+				return null;
+			}
+		},
+		subscribe(cb) {
+			const notify = () => {
+				try {
+					cb();
+				} catch (_unused3) {}
+			};
+			return listenToWindowEvents([
+				"CookiebotOnConsentReady",
+				"CookiebotOnAccept",
+				"CookiebotOnDecline"
+			], notify);
+		}
+	};
+};
+//#endregion
+//#region src/consent-sources/index.ts
+/**
+* Consent-source registry.
+*
+* Maps the source names a customer puts in `config.consentSources` (plumbed from
+* the CDN wrapper's `data-consent-source` attribute) to their factory. Accepts
+* both the canonical source ids and a couple of friendly aliases.
+*/
+const SOURCE_FACTORIES = {
+	concord: createConcordSource,
+	onetrust: createOneTrustSource,
+	usercentrics: createUsercentricsSource,
+	cookiebot: createCookiebotSource,
+	gcm: createGcmReaderSource,
+	google_consent_mode: createGcmReaderSource
+};
+const normalizeName = (name) => name.trim().toLowerCase();
+/**
+* Instantiate the consent sources named in `names`. Unknown names are skipped
+* (logged once); a factory returning `null` is skipped silently. Duplicate names
+* collapse to a single instance. Never throws.
+*/
+const instantiateConsentSources = (names) => {
+	const seen = /* @__PURE__ */ new Set();
+	const sources = [];
+	for (const rawName of names) {
+		const key = normalizeName(rawName);
+		if (!key || seen.has(key)) continue;
+		seen.add(key);
+		const factory = SOURCE_FACTORIES[key];
+		if (!factory) {
+			try {
+				console.warn(`Leapio - unknown consent source "${rawName}" ignored`);
+			} catch (_unused) {}
+			continue;
+		}
+		try {
+			const source = factory();
+			if (source) sources.push(source);
+		} catch (_unused2) {}
+	}
+	return sources;
+};
+/**
+* Owns the lifecycle of the registered consent sources. On `start()` it reads
+* each source's current snapshot, applies it through `applySnapshot` (the store
+* enforces priority, so order does not matter), and subscribes to each source's
+* change events — re-reading and re-applying on every callback. `stop()` tears
+* down every subscription (used by `reset()`).
+*
+* `applySnapshot` is the SDK seam (`leapio.applyConsentSnapshot`): it returns a
+* promise resolving to whether the snapshot became authoritative. The registry
+* fires it and does not block source setup on the resulting `/consent` POST.
+*/
+var ConsentSourceRegistry = class {
+	constructor(sources, applySnapshot) {
+		this.applySnapshot = applySnapshot;
+		this.unsubscribers = [];
+		this.started = false;
+		this.sources = sources;
+	}
+	/** Number of registered sources (0 means the registry is a no-op). */
+	get size() {
+		return this.sources.length;
+	}
+	/**
+	* Read each source's current state and subscribe for changes. Safe to call
+	* when no vendor global is present yet: `read()` returns `null` (nothing
+	* applied) and the subscriptions stay live so a later vendor load is picked
+	* up. Idempotent — a second call is a no-op.
+	*/
+	start() {
+		if (this.started) return;
+		this.started = true;
+		for (const source of this.sources) {
+			try {
+				const unsubscribe = source.subscribe(() => {
+					this.applyFrom(source);
+				});
+				if (typeof unsubscribe === "function") this.unsubscribers.push(unsubscribe);
+			} catch (_unused3) {}
+			this.applyFrom(source);
+		}
+	}
+	/** Read one source and push its snapshot through the priority-aware store. */
+	applyFrom(source) {
+		let snapshot = null;
+		try {
+			snapshot = source.read();
+		} catch (_unused4) {
+			snapshot = null;
+		}
+		if (!snapshot) return;
+		this.applySnapshot(snapshot).catch(() => {});
+	}
+	/** Tear down every subscription. Called by `reset()`. Idempotent. */
+	stop() {
+		while (this.unsubscribers.length > 0) {
+			const off = this.unsubscribers.pop();
+			try {
+				off === null || off === void 0 || off();
+			} catch (_unused5) {}
+		}
+		this.started = false;
+	}
+};
+//#endregion
+//#region src/autocapture.ts
+/** Attribute used to fire a declarative event on click. */
+const DECLARATIVE_EVENT_ATTR = "data-leapio-event";
+const LEGACY_DECLARATIVE_EVENT_ATTR = "data-lgspt-event";
+const LEGACY_DECLARATIVE_PROP_PREFIX = "data-lgspt-prop-";
+const LEGACY_SENSITIVE_ATTR = "data-lgspt-sensitive";
+/** Prefix for declarative metadata props, e.g. `data-leapio-prop-plan="pro"`. */
+const DECLARATIVE_PROP_PREFIX = "data-leapio-prop-";
+const SENSITIVE_SELECTOR = `[data-leapio-sensitive],[${LEGACY_SENSITIVE_ATTR}]`;
+/**
+* File extensions treated as downloads. A click on an `a[href]` whose path ends
+* in one of these (case-insensitive) emits `File Downloaded`. Pure metadata —
+* no PII. (An explicit `download` attribute also qualifies, regardless of
+* extension.) This is the SDK's built-in default; the server config can replace
+* it per project.
+*/
+const DOWNLOAD_EXTENSIONS = [
+	"pdf",
+	"zip",
+	"csv",
+	"xlsx",
+	"doc",
+	"docx",
+	"ppt",
+	"pptx",
+	"dmg",
+	"pkg",
+	"mp3",
+	"mp4",
+	"wav"
+];
+/**
+* Per-type defaults. `clicks` and `inputChanges` are noisy, so they default
+* OFF; `outboundLinks`, `fileDownloads`, and `formSubmissions` are high-signal
+* and default ON (once autocapture itself is enabled — autocapture is still off
+* by default). `mediaPlayback` is audience-dependent (only relevant on pages
+* with native media), so it also defaults OFF.
+*/
+const AUTOCAPTURE_DEFAULTS = {
+	outboundLinks: true,
+	fileDownloads: true,
+	formSubmissions: true,
+	clicks: false,
+	inputChanges: false,
+	mediaPlayback: false
+};
+/** Max characters of captured text before we treat the element as non-atomic. */
+const MAX_TEXT_LENGTH = 500;
+/** Truncate captured text to this length in emitted metadata. */
+const TEXT_SLICE = 200;
+/**
+* Playback-progress milestones (as fractions of duration) that emit a discrete
+* `Media Progress` event the first time playback crosses each one. 100% is the
+* `ended`/`Media Completed` event, not a progress milestone.
+*/
+const MEDIA_PROGRESS_THRESHOLDS = [
+	.25,
+	.5,
+	.75
+];
+/** The per-type keys the SDK currently understands (server may carry more). */
+const AUTOCAPTURE_TYPE_KEYS = [
+	"outboundLinks",
+	"fileDownloads",
+	"formSubmissions",
+	"clicks",
+	"inputChanges",
+	"mediaPlayback"
+];
+/** Any object carrying a `master` or `types` key is the snippet shape. */
+const isSnippetConfig = (value) => "master" in value || "types" in value;
+/**
+* Normalize the three accepted snippet input shapes into a single
+* `{ master, types }` form that separates master enablement from per-type
+* overrides:
+*
+* - `boolean` → `{ master: <bool>, types: {} }`.
+* - {@link AutocaptureConfig} (plain object) → `{ master: true, types: <obj> }`
+*   (the direct-`init()` convenience: passing an object means enable).
+* - {@link AutocaptureSnippetConfig} `{ master, types }` → passed through, with
+*   `master` possibly `undefined` (per-type-only attrs do NOT enable).
+* - `undefined` → `{ master: undefined, types: {} }`.
+*
+* Exported so the override-reporting path (`ac-overrides.ts`) can derive the
+* EXPLICIT snippet override set from the same normalization the resolver uses.
+*/
+const normalizeSnippet = (snippet) => {
+	if (typeof snippet === "boolean") return {
+		master: snippet,
+		types: {}
+	};
+	if (typeof snippet !== "object" || snippet === null) return {
+		master: void 0,
+		types: {}
+	};
+	if (isSnippetConfig(snippet)) {
+		var _snippet$types;
+		return {
+			master: snippet.master,
+			types: (_snippet$types = snippet.types) !== null && _snippet$types !== void 0 ? _snippet$types : {}
+		};
+	}
+	return {
+		master: true,
+		types: snippet
+	};
+};
+/** Normalize an extension for matching: lowercase + strip a single leading dot. */
+const normalizeExtension = (ext) => ext.trim().replace(/^\./, "").toLowerCase();
+/**
+* Resolve the EFFECTIVE config from three sources, merged **per key**.
+*
+* Enablement (master): `snippetMaster ?? server.enabled ?? false`. The snippet's
+* master is `true`/`false` only when explicitly set (`data-autocapture`, a
+* plain `init()` object, or `enableAutoClicks`); a bare per-type attribute
+* leaves it `undefined`, so it can override a type but never flips the master
+* on. When the master resolves OFF this returns `null` (no listeners attached) —
+* the fail-safe default when neither snippet nor server enables it.
+*
+* Per-type (applies only when the master is on): `snippetType ?? serverType ??
+* default`. A snippet value wins in either direction (on AND off); else the
+* server config (delivered on the track response, cached in localStorage); else
+* {@link AUTOCAPTURE_DEFAULTS}. Only `{ outboundLinks, fileDownloads,
+* formSubmissions, mediaPlayback }` are read from the server — `clicks` /
+* `inputChanges` are snippet-only, and any extra server keys (e.g. `notFound`)
+* are ignored.
+*
+* The legacy `enableAutoClicks` flag counts as a snippet-side `clicks: true`.
+*/
+const resolveEffectiveAutocaptureConfig = (snippet, enableAutoClicks, remote) => {
+	var _ref, _server$types, _server$downloads;
+	const server = remote === null || remote === void 0 ? void 0 : remote.autocapture;
+	const { master: snippetMaster, types: snippetTypes } = normalizeSnippet(snippet);
+	const snippetEnable = snippetMaster !== null && snippetMaster !== void 0 ? snippetMaster : enableAutoClicks ? true : void 0;
+	const serverEnable = typeof (server === null || server === void 0 ? void 0 : server.enabled) === "boolean" ? server.enabled : void 0;
+	if (!((_ref = snippetEnable !== null && snippetEnable !== void 0 ? snippetEnable : serverEnable) !== null && _ref !== void 0 ? _ref : false)) return null;
+	const serverTypes = (_server$types = server === null || server === void 0 ? void 0 : server.types) !== null && _server$types !== void 0 ? _server$types : {};
+	const SERVER_TYPE_KEYS = /* @__PURE__ */ new Set([
+		"outboundLinks",
+		"fileDownloads",
+		"formSubmissions",
+		"mediaPlayback"
+	]);
+	const resolved = _objectSpread2({}, AUTOCAPTURE_DEFAULTS);
+	for (const key of AUTOCAPTURE_TYPE_KEYS) {
+		const snippetValue = snippetTypes[key];
+		const serverValue = SERVER_TYPE_KEYS.has(key) ? serverTypes[key] : void 0;
+		resolved[key] = typeof snippetValue === "boolean" ? snippetValue : typeof serverValue === "boolean" ? serverValue : AUTOCAPTURE_DEFAULTS[key];
+	}
+	if (enableAutoClicks && snippetTypes.clicks === void 0) resolved.clicks = true;
+	const serverExtensions = server === null || server === void 0 || (_server$downloads = server.downloads) === null || _server$downloads === void 0 ? void 0 : _server$downloads.extensions;
+	const downloadExtensions = Array.isArray(serverExtensions) && serverExtensions.length > 0 ? serverExtensions.map(normalizeExtension).filter(Boolean) : DOWNLOAD_EXTENSIONS;
+	return _objectSpread2(_objectSpread2({}, resolved), {}, { downloadExtensions });
+};
+/**
+* Wire up delegated autocapture listeners. Returns a teardown function that
+* removes every listener it added. The host passes `track` (already DNT/consent
+* aware) and `shouldTrack` (re-checked on every event so a later DNT/disable
+* still short-circuits). Declarative `data-leapio-event` capture is always on
+* when autocapture is enabled.
+*/
+const setupAutocapture = (params) => {
+	var _params$doc;
+	const { config, track, shouldTrack } = params;
+	const doc = (_params$doc = params.doc) !== null && _params$doc !== void 0 ? _params$doc : document;
+	const teardowns = [];
+	const onClick = (event) => {
+		if (!shouldTrack()) return;
+		const target = eventTarget(event);
+		if (!target) return;
+		if (target.closest(SENSITIVE_SELECTOR)) return;
+		const declarative = findDeclarativeEvent(target);
+		if (declarative) {
+			track(declarative);
+			return;
+		}
+		if (config.fileDownloads) {
+			const download = buildDownloadEvent(target, doc, config.downloadExtensions);
+			if (download) {
+				track(download);
+				return;
+			}
+		}
+		if (config.outboundLinks) {
+			const outbound = buildOutboundEvent(target, doc);
+			if (outbound) {
+				track(outbound);
+				return;
+			}
+		}
+		if (config.clicks) {
+			const click = buildClickEvent(target);
+			if (click) track(click);
+		}
+	};
+	const onAuxClick = (event) => {
+		if (!(event instanceof MouseEvent) || event.button !== 1) return;
+		if (!shouldTrack()) return;
+		const target = eventTarget(event);
+		if (!target || target.closest(SENSITIVE_SELECTOR)) return;
+		if (config.fileDownloads) {
+			const download = buildDownloadEvent(target, doc, config.downloadExtensions);
+			if (download) {
+				track(download);
+				return;
+			}
+		}
+		if (config.outboundLinks) {
+			const outbound = buildOutboundEvent(target, doc);
+			if (outbound) track(outbound);
+		}
+	};
+	const onSubmit = (event) => {
+		if (!shouldTrack()) return;
+		if (!config.formSubmissions) return;
+		const target = eventTarget(event);
+		const form = target === null || target === void 0 ? void 0 : target.closest("form");
+		if (!form) return;
+		if (form.closest(SENSITIVE_SELECTOR)) return;
+		track(buildFormEvent(form, doc));
+	};
+	const onChange = (event) => {
+		if (!shouldTrack()) return;
+		if (!config.inputChanges) return;
+		const target = eventTarget(event);
+		const field = target === null || target === void 0 ? void 0 : target.closest("input, select, textarea");
+		if (!field) return;
+		if (isSensitiveField(field)) return;
+		track(buildInputEvent(field));
+	};
+	const mediaMilestones = /* @__PURE__ */ new WeakMap();
+	const mediaTarget = (event) => {
+		const target = event.target;
+		return target instanceof HTMLMediaElement ? target : null;
+	};
+	const onMediaPlay = (event) => {
+		if (!shouldTrack()) return;
+		if (!config.mediaPlayback) return;
+		const media = mediaTarget(event);
+		if (!media || isSensitiveMedia(media)) return;
+		track(buildMediaEvent(media, "Media Played"));
+	};
+	const onMediaPause = (event) => {
+		if (!shouldTrack()) return;
+		if (!config.mediaPlayback) return;
+		const media = mediaTarget(event);
+		if (!media || isSensitiveMedia(media)) return;
+		if (media.ended) return;
+		track(buildMediaEvent(media, "Media Paused"));
+	};
+	const onMediaTimeUpdate = (event) => {
+		if (!shouldTrack()) return;
+		if (!config.mediaPlayback) return;
+		const media = mediaTarget(event);
+		if (!media || isSensitiveMedia(media)) return;
+		const duration = media.duration;
+		const currentTime = media.currentTime;
+		if (!Number.isFinite(duration) || duration <= 0) return;
+		let crossed = mediaMilestones.get(media);
+		if (!crossed) {
+			crossed = /* @__PURE__ */ new Set();
+			mediaMilestones.set(media, crossed);
+		}
+		if (currentTime <= 0 && crossed.size > 0) crossed.clear();
+		const percent = currentTime / duration;
+		for (const threshold of MEDIA_PROGRESS_THRESHOLDS) if (percent >= threshold && !crossed.has(threshold)) {
+			crossed.add(threshold);
+			track(buildMediaEvent(media, "Media Progress", String(Math.round(threshold * 100))));
+		}
+	};
+	const onMediaEnded = (event) => {
+		if (!shouldTrack()) return;
+		if (!config.mediaPlayback) return;
+		const media = mediaTarget(event);
+		if (!media || isSensitiveMedia(media)) return;
+		mediaMilestones.delete(media);
+		track(buildMediaEvent(media, "Media Completed", "100"));
+	};
+	doc.addEventListener("click", onClick, true);
+	teardowns.push(() => doc.removeEventListener("click", onClick, true));
+	if (config.fileDownloads || config.outboundLinks) {
+		doc.addEventListener("auxclick", onAuxClick, true);
+		teardowns.push(() => doc.removeEventListener("auxclick", onAuxClick, true));
+	}
+	if (config.formSubmissions) {
+		doc.addEventListener("submit", onSubmit, true);
+		teardowns.push(() => doc.removeEventListener("submit", onSubmit, true));
+	}
+	if (config.inputChanges) {
+		doc.addEventListener("change", onChange, true);
+		teardowns.push(() => doc.removeEventListener("change", onChange, true));
+	}
+	if (config.mediaPlayback) {
+		doc.addEventListener("play", onMediaPlay, true);
+		doc.addEventListener("pause", onMediaPause, true);
+		doc.addEventListener("timeupdate", onMediaTimeUpdate, true);
+		doc.addEventListener("ended", onMediaEnded, true);
+		teardowns.push(() => {
+			doc.removeEventListener("play", onMediaPlay, true);
+			doc.removeEventListener("pause", onMediaPause, true);
+			doc.removeEventListener("timeupdate", onMediaTimeUpdate, true);
+			doc.removeEventListener("ended", onMediaEnded, true);
+		});
+	}
+	return () => {
+		for (const teardown of teardowns) teardown();
+	};
+};
+/** Narrow an event's target to an Element, or null for non-element targets. */
+const eventTarget = (event) => {
+	const target = event.target;
+	return target instanceof Element ? target : null;
+};
+/**
+* Declarative `data-leapio-event` capture. Walks to the nearest ancestor (or
+* self) carrying the attribute and collects `data-leapio-prop-*` props into
+* metadata. Supersedes the bare `lgspt-` classname approach.
+*/
+const findDeclarativeEvent = (target) => {
+	var _el$getAttribute;
+	const el = target.closest(`[${DECLARATIVE_EVENT_ATTR}],[${LEGACY_DECLARATIVE_EVENT_ATTR}]`);
+	if (!(el instanceof HTMLElement)) return null;
+	const eventName = (_el$getAttribute = el.getAttribute("data-leapio-event")) !== null && _el$getAttribute !== void 0 ? _el$getAttribute : el.getAttribute(LEGACY_DECLARATIVE_EVENT_ATTR);
+	if (!eventName) return null;
+	const metadata = {};
+	for (const attr of Array.from(el.attributes)) {
+		const prefix = [DECLARATIVE_PROP_PREFIX, LEGACY_DECLARATIVE_PROP_PREFIX].find((candidate) => attr.name.startsWith(candidate));
+		if (prefix) {
+			const key = attr.name.slice(prefix.length);
+			if (key) metadata[key] = attr.value;
+		}
+	}
+	return {
+		event: eventName,
+		metadata
+	};
+};
+/**
+* Outbound-link capture. Fires only when the closest `a[href]` resolves to a
+* different host than the current page, and is not a same-page anchor / mailto
+* / tel link.
+*/
+const buildOutboundEvent = (target, doc) => {
+	var _doc$location, _elementText;
+	const resolved = resolveNavigableAnchor(target, doc);
+	if (!resolved) return null;
+	const { anchor, url } = resolved;
+	if (!url.host || url.host === ((_doc$location = doc.location) === null || _doc$location === void 0 ? void 0 : _doc$location.host)) return null;
+	return {
+		event: "Outbound Link",
+		metadata: {
+			href: anchor.href || anchor.getAttribute("href") || void 0,
+			text: (_elementText = elementText(anchor)) === null || _elementText === void 0 ? void 0 : _elementText.slice(0, TEXT_SLICE)
+		}
+	};
+};
+const resolveNavigableAnchor = (target, doc) => {
+	var _anchor$getAttribute;
+	const anchor = target.closest("a[href]");
+	if (!(anchor instanceof HTMLAnchorElement)) return null;
+	const rawHref = (_anchor$getAttribute = anchor.getAttribute("href")) !== null && _anchor$getAttribute !== void 0 ? _anchor$getAttribute : "";
+	if (!rawHref) return null;
+	if (rawHref.startsWith("#") || /^(mailto:|tel:|sms:|javascript:)/i.test(rawHref)) return null;
+	let url;
+	try {
+		var _doc$location2;
+		url = new URL(anchor.href || rawHref, (_doc$location2 = doc.location) === null || _doc$location2 === void 0 ? void 0 : _doc$location2.href);
+	} catch (_unused) {
+		return null;
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+	return {
+		anchor,
+		url
+	};
+};
+/**
+* File-download capture. Fires on a click of an `a[href]` that either carries a
+* `download` attribute or whose resolved path ends in a known download
+* extension. The extension allowlist is the effective config's
+* `downloadExtensions` (server-provided list when present, else the built-in
+* {@link DOWNLOAD_EXTENSIONS}); both the configured extensions and the URL's
+* extension are normalized (lowercase, no leading dot) for matching. Pure
+* metadata — `{ href, fileName, fileExtension }`, no PII. Same-page anchors and
+* non-navigational schemes (mailto/tel/sms/javascript) are never downloads.
+*/
+const buildDownloadEvent = (target, doc, extensions) => {
+	const resolved = resolveNavigableAnchor(target, doc);
+	if (!resolved) return null;
+	const { anchor, url } = resolved;
+	const hasDownloadAttr = anchor.hasAttribute("download");
+	const fileExtension = fileExtensionFromPath(url.pathname);
+	const isKnownExtension = !!fileExtension && extensions.some((ext) => normalizeExtension(ext) === fileExtension);
+	if (!hasDownloadAttr && !isKnownExtension) return null;
+	return {
+		event: "File Downloaded",
+		metadata: {
+			href: anchor.href || anchor.getAttribute("href") || void 0,
+			fileName: fileNameFromPath(url.pathname),
+			fileExtension
+		}
+	};
+};
+/** Form-submission capture. Metadata only — field values are never read. */
+const buildFormEvent = (form, doc) => ({
+	event: "Form Submitted",
+	metadata: {
+		id: attr(form, "id"),
+		name: attr(form, "name"),
+		action: formAction(form, doc)
+	}
+});
+const formAction = (form, doc) => {
+	const rawAction = attr(form, "action");
+	if (!rawAction) return void 0;
+	try {
+		var _doc$location3;
+		const resolved = new URL(rawAction, (_doc$location3 = doc.location) === null || _doc$location3 === void 0 ? void 0 : _doc$location3.href);
+		return `${resolved.protocol}//${resolved.host}${resolved.pathname}`;
+	} catch (_unused2) {
+		return rawAction.split(/[?#]/)[0] || void 0;
+	}
+};
+/**
+* Generic click capture (off by default). Targets the nearest interactive
+* element. Skips elements whose visible text exceeds {@link MAX_TEXT_LENGTH}
+* (the fixed length-guard: compares `.length`, not the string itself).
+*/
+const buildClickEvent = (target) => {
+	var _target$closest;
+	const el = (_target$closest = target.closest("a, button, [role=button]")) !== null && _target$closest !== void 0 ? _target$closest : target;
+	const text = el.matches("input, textarea, select, optgroup, option") ? void 0 : elementText(el);
+	if (text && text.length > MAX_TEXT_LENGTH) return null;
+	return {
+		event: "Click",
+		metadata: {
+			tag: el.tagName,
+			id: attr(el, "id"),
+			text: text === null || text === void 0 ? void 0 : text.slice(0, TEXT_SLICE),
+			href: el instanceof HTMLAnchorElement ? el.href || void 0 : void 0
+		}
+	};
+};
+/** Input-change capture. Metadata only — the value is NEVER captured. */
+const buildInputEvent = (field) => ({
+	event: "Input Changed",
+	metadata: {
+		name: attr(field, "name"),
+		type: fieldType(field)
+	}
+});
+/**
+* Native `<video>`/`<audio>` engagement capture (metadata only — never a
+* recording). `percent` is set only for `Media Progress` (the milestone) and
+* `Media Completed` (`"100"`). `duration`/`current_time` are rounded whole
+* seconds; `duration` is omitted for non-finite values (e.g. live streams). The
+* `src` is the element `id` when present, else the basename of `currentSrc`/
+* `src` (filename only — query string dropped to avoid leaking URLs/PII).
+*/
+const buildMediaEvent = (media, event, percent) => {
+	const duration = media.duration;
+	return {
+		event,
+		metadata: {
+			media_type: media instanceof HTMLVideoElement ? "video" : "audio",
+			src: mediaSource(media),
+			title: mediaTitle(media),
+			percent,
+			duration: Number.isFinite(duration) ? String(Math.round(duration)) : void 0,
+			current_time: String(Math.round(media.currentTime))
+		}
+	};
+};
+/**
+* Whether a media element is flagged sensitive and must be skipped. Mirrors the
+* input opt-out: the element itself or any ancestor carrying
+* `data-leapio-sensitive`.
+*/
+const isSensitiveMedia = (media) => media.closest(SENSITIVE_SELECTOR) !== null;
+/**
+* Stable identifier for a media element: its `id` when present, else the
+* basename (filename only, query string dropped) of `currentSrc`/`src`. Returns
+* undefined when there is no usable source — never the full URL, to avoid
+* leaking PII in query params.
+*/
+const mediaSource = (media) => {
+	const id = attr(media, "id");
+	if (id) return id;
+	const raw = media.currentSrc || media.src;
+	if (!raw) return void 0;
+	return urlBasename(raw);
+};
+/**
+* Best-effort human label for a media element: `aria-label`, else the `title`
+* attribute, else the nearest `<label>`/`<figcaption>` text, else the source
+* filename. Truncated to {@link TEXT_SLICE}. Undefined when nothing is found.
+*/
+const mediaTitle = (media) => {
+	var _media$closest;
+	const ariaLabel = attr(media, "aria-label");
+	if (ariaLabel) return ariaLabel.slice(0, TEXT_SLICE);
+	const title = attr(media, "title");
+	if (title) return title.slice(0, TEXT_SLICE);
+	const figcaption = (_media$closest = media.closest("figure")) === null || _media$closest === void 0 ? void 0 : _media$closest.querySelector("figcaption");
+	const captionText = figcaption ? elementText(figcaption) : void 0;
+	if (captionText) return captionText.slice(0, TEXT_SLICE);
+	const label = media.closest("label");
+	const labelText = label ? elementText(label) : void 0;
+	if (labelText) return labelText.slice(0, TEXT_SLICE);
+	const raw = media.currentSrc || media.src;
+	return raw ? urlBasename(raw) : void 0;
+};
+/**
+* Filename (last path segment) of a URL, with the query string and hash
+* dropped. Resolves relative to the page so jsdom and the browser agree.
+* Returns undefined when there is no meaningful segment.
+*/
+const urlBasename = (raw) => {
+	try {
+		var _document$location;
+		const url = new URL(raw, (_document$location = document.location) === null || _document$location === void 0 ? void 0 : _document$location.href);
+		return fileNameFromPath(url.pathname);
+	} catch (_unused3) {
+		const withoutQuery = raw.split(/[?#]/)[0];
+		return fileNameFromPath(withoutQuery);
+	}
+};
+/**
+* Whether an input/select/textarea is sensitive and must be skipped. Covers
+* password fields, one-time codes, credit-card autofill, stored credentials,
+* and any element (or ancestor) marked `data-leapio-sensitive`.
+*/
+const isSensitiveField = (field) => {
+	var _field$getAttribute, _field$getAttribute2;
+	if (field.closest(SENSITIVE_SELECTOR)) return true;
+	if (((_field$getAttribute = field.getAttribute("type")) !== null && _field$getAttribute !== void 0 ? _field$getAttribute : "").toLowerCase() === "password") return true;
+	const autocomplete = ((_field$getAttribute2 = field.getAttribute("autocomplete")) !== null && _field$getAttribute2 !== void 0 ? _field$getAttribute2 : "").toLowerCase();
+	if (autocomplete) {
+		if (autocomplete.includes("one-time-code") || autocomplete.includes("current-password") || autocomplete.includes("new-password") || autocomplete.includes("cc-")) return true;
+	}
+	return false;
+};
+/**
+* Last path segment of a URL pathname (the file name), decoded and trimmed of
+* trailing slashes. Returns undefined when there is no meaningful segment.
+*/
+const fileNameFromPath = (pathname) => {
+	const segments = pathname.split("/").filter(Boolean);
+	const last = segments[segments.length - 1];
+	if (!last) return void 0;
+	try {
+		return decodeURIComponent(last);
+	} catch (_unused4) {
+		return last;
+	}
+};
+/**
+* Lower-cased extension (without the dot) of a URL pathname's file name, or
+* undefined when there is no dotted extension.
+*/
+const fileExtensionFromPath = (pathname) => {
+	const fileName = fileNameFromPath(pathname);
+	if (!fileName) return void 0;
+	const dot = fileName.lastIndexOf(".");
+	if (dot <= 0 || dot === fileName.length - 1) return void 0;
+	return fileName.slice(dot + 1).toLowerCase();
+};
+const fieldType = (field) => {
+	const explicit = field.getAttribute("type");
+	if (explicit) return explicit;
+	return field.tagName.toLowerCase();
+};
+const attr = (el, name) => {
+	const value = el.getAttribute(name);
+	return value === null || value === "" ? void 0 : value;
+};
+/** Visible text of an element, trimmed. Returns undefined when empty. */
+const elementText = (el) => {
+	var _ref2, _ref3;
+	const text = ((_ref2 = (_ref3 = el instanceof HTMLElement ? el.innerText : null) !== null && _ref3 !== void 0 ? _ref3 : el.textContent) !== null && _ref2 !== void 0 ? _ref2 : "").trim();
+	return text.length ? text : void 0;
+};
+//#endregion
+//#region src/dnt.ts
+const hasExplicitDNT = () => {
+	const DNT_KEY = "leapio_dnt";
+	const LEGACY_DNT_KEY = "lgspt_dnt";
+	const urlSearchParams = new URLSearchParams(window.location.search);
+	const params = Object.fromEntries(urlSearchParams.entries());
+	if (params.dnt === "false" || params.dnt === "0") {
+		localStorage.removeItem(DNT_KEY);
+		localStorage.removeItem(LEGACY_DNT_KEY);
+		return false;
+	}
+	const queryWithDNT = typeof params.dnt !== "undefined";
+	const disableTracking = queryWithDNT || localStorage.getItem(DNT_KEY) === "1" || localStorage.getItem(LEGACY_DNT_KEY) === "1";
+	if (queryWithDNT) localStorage.setItem(DNT_KEY, "1");
+	return disableTracking;
+};
+const hasBrowserDNT = () => {
+	return navigator.doNotTrack === "1" || navigator.doNotTrack === "yes" || window.doNotTrack === "1";
+};
+const isAutomatedBrowser = () => navigator.webdriver === true;
+//#endregion
+//#region src/engagement.ts
+const ENGAGEMENT_MODES = [
+	"off",
+	"leave",
+	"heartbeat"
+];
+const HEARTBEAT_INTERVAL_MS = 6e4;
+const MIN_REPORT_MS = 1e3;
+const isEngagementMode = (value) => ENGAGEMENT_MODES.includes(value);
+/**
+* Count visible time on the current page and report it per `mode`. `send`
+* must capture the page context synchronously (the leave report for an SPA
+* route change fires before the SDK advances to the new url).
+*/
+const setupEngagement = (opts) => {
+	var _opts$now;
+	const now = (_opts$now = opts.now) !== null && _opts$now !== void 0 ? _opts$now : Date.now;
+	const isVisible = () => document.visibilityState === "visible";
+	let visibleSince = isVisible() ? now() : null;
+	let unreportedMs = 0;
+	let leaves = 0;
+	let heartbeats = 0;
+	const collect = () => {
+		if (visibleSince !== null) {
+			const at = now();
+			unreportedMs += at - visibleSince;
+			visibleSince = isVisible() ? at : null;
+		}
+	};
+	const report = (event) => {
+		if (unreportedMs < MIN_REPORT_MS) return false;
+		opts.send(event, { engaged_seconds: Math.round(unreportedMs / 1e3) });
+		unreportedMs = 0;
+		return true;
+	};
+	const leave = () => {
+		collect();
+		if (leaves < 10 && report("Page Leave")) leaves++;
+	};
+	const onVisibilityChange = () => {
+		if (isVisible()) {
+			if (visibleSince === null) visibleSince = now();
+		} else leave();
+	};
+	document.addEventListener("visibilitychange", onVisibilityChange);
+	window.addEventListener("pagehide", leave);
+	const timer = opts.mode === "heartbeat" ? setInterval(() => {
+		if (!isVisible() || heartbeats >= 30) return;
+		collect();
+		if (report("Page Heartbeat")) heartbeats++;
+	}, HEARTBEAT_INTERVAL_MS) : null;
+	return {
+		pageChanged: () => {
+			leave();
+			leaves = 0;
+			heartbeats = 0;
+			unreportedMs = 0;
+			visibleSince = isVisible() ? now() : null;
+		},
+		teardown: () => {
+			document.removeEventListener("visibilitychange", onVisibilityChange);
+			window.removeEventListener("pagehide", leave);
+			if (timer !== null) clearInterval(timer);
+		}
+	};
+};
+//#endregion
+//#region src/payment-links.ts
+const STRIPE_PAYMENT_LINK_HOST = "buy.stripe.com";
+const CLIENT_REFERENCE_PARAM = "client_reference_id";
+/** The href with the anonymous id added, or null when it should be left as is. */
+const tagPaymentLinkHref = (href, anonymousId) => {
+	let url;
+	try {
+		url = new URL(href);
+	} catch (_unused) {
+		return null;
+	}
+	if (url.hostname !== STRIPE_PAYMENT_LINK_HOST) return null;
+	if (url.searchParams.has(CLIENT_REFERENCE_PARAM)) return null;
+	url.searchParams.set(CLIENT_REFERENCE_PARAM, anonymousId);
+	return url.toString();
+};
+const ownTags = /* @__PURE__ */ new WeakMap();
+/**
+* Tag Stripe Payment Link anchors on press. `pointerdown` runs before the
+* context menu, so "open in new tab" gets the tagged href too; `click` and
+* `auxclick` cover keyboard activation and middle-click. Returns a teardown.
+*/
+const listenForPaymentLinks = (opts) => {
+	const onPress = (event) => {
+		var _target$closest;
+		if (!opts.shouldTag()) return;
+		const target = event.target;
+		const anchor = target === null || target === void 0 || (_target$closest = target.closest) === null || _target$closest === void 0 ? void 0 : _target$closest.call(target, "a[href]");
+		const anonymousId = opts.getAnonymousId();
+		if (!anchor || !anonymousId) return;
+		const own = ownTags.get(anchor);
+		const from = own && own.to === anchor.href ? own.from : anchor.href;
+		const tagged = tagPaymentLinkHref(from, anonymousId);
+		if (tagged) {
+			anchor.href = tagged;
+			ownTags.set(anchor, {
+				from,
+				to: anchor.href
+			});
+		}
+	};
+	const events = [
+		"pointerdown",
+		"click",
+		"auxclick"
+	];
+	for (const name of events) document.addEventListener(name, onPress, true);
+	return () => {
+		for (const name of events) document.removeEventListener(name, onPress, true);
+	};
+};
+//#endregion
+//#region src/privacy-signals.ts
+/**
+* Read GPC. Returns `true` only when the browser explicitly exposes the signal
+* as enabled; `undefined` when the API is absent (so callers can distinguish
+* "not present" from "present and false").
+*/
+const detectGpc = () => {
+	try {
+		if (typeof navigator === "undefined") return void 0;
+		const value = navigator.globalPrivacyControl;
+		if (typeof value === "boolean") return value;
+		return;
+	} catch (_unused) {
+		return;
+	}
+};
+const getGppApi = () => {
+	try {
+		if (typeof window === "undefined") return void 0;
+		const api = window.__gpp;
+		return typeof api === "function" ? api : void 0;
+	} catch (_unused2) {
+		return;
+	}
+};
+/**
+* Synchronously probe for GPP via `__gpp('ping', cb)`. The IAB stub invokes the
+* callback synchronously, so the result is available immediately in practice;
+* if a host implementation is async, the synchronous read simply returns
+* "not detected" and a later `subscribeGpp` event updates state.
+*/
+const detectGpp = () => {
+	const api = getGppApi();
+	if (!api) return { detected: false };
+	let detected = false;
+	let gppString;
+	try {
+		api("ping", (data, success) => {
+			if (!success || !data || typeof data !== "object") return;
+			detected = true;
+			const ping = data;
+			if (typeof ping.gppString === "string" && ping.gppString.length > 0) gppString = ping.gppString;
+		});
+	} catch (_unused3) {
+		detected = true;
+	}
+	return {
+		detected,
+		gppString
+	};
+};
+/**
+* Subscribe to GPP section/string changes via `__gpp('addEventListener', cb)`.
+* Calls `onChange` whenever the GPP string is (re)computed. Returns an
+* unsubscribe function (best-effort `removeEventListener`).
+*/
+const subscribeGpp = (onChange) => {
+	const api = getGppApi();
+	if (!api) return () => {};
+	let listenerId;
+	try {
+		api("addEventListener", (data, success) => {
+			var _event$pingData;
+			if (!success || !data || typeof data !== "object") return;
+			const event = data;
+			if (typeof event.listenerId !== "undefined") listenerId = event.listenerId;
+			onChange({
+				detected: true,
+				gppString: typeof ((_event$pingData = event.pingData) === null || _event$pingData === void 0 ? void 0 : _event$pingData.gppString) === "string" ? event.pingData.gppString : typeof event.gppString === "string" ? event.gppString : void 0
+			});
+		});
+	} catch (_unused4) {
+		return () => {};
+	}
+	return () => {
+		try {
+			if (typeof listenerId !== "undefined") api("removeEventListener", () => {}, listenerId);
+		} catch (_unused5) {}
+	};
+};
+/**
+* Detect all currently-readable browser privacy signals as a `PrivacySignals`
+* fragment suitable for merging into a consent snapshot. Only signals that are
+* actually present are included.
+*/
+const detectPrivacySignals = () => {
+	const signals = {};
+	if (detectGpc() === true) signals.gpc = true;
+	const gpp = detectGpp();
+	if (gpp.detected) {
+		signals.gppDetected = true;
+		if (gpp.gppString) signals.gppString = gpp.gppString;
+	}
+	return signals;
+};
+//#endregion
+//#region src/super-properties.ts
+var SuperProperties = class {
+	constructor(sdkConfig) {
+		this.sdkConfig = sdkConfig;
+		this.PROPS_COOKIE = "leapio_p";
+		this.LEGACY_PROPS_COOKIE = "lgspt_p";
+		this.expiryDays = 30;
+		try {
+			var _getCookie;
+			const cookie = (_getCookie = getCookie(this.PROPS_COOKIE)) !== null && _getCookie !== void 0 ? _getCookie : getCookie(this.LEGACY_PROPS_COOKIE);
+			this.properties = cookie ? JSON.parse(this.UnicodeDecodeB64(cookie)) : {};
+		} catch (_unused) {
+			this.properties = {};
+		}
+	}
+	register(newProps, days) {
+		this.properties = _objectSpread2(_objectSpread2({}, this.properties), newProps);
+		if (typeof days !== "undefined") this.expiryDays = days;
+		this._save();
+	}
+	unregister(property) {
+		delete this.properties[property];
+		this._save();
+	}
+	clear() {
+		var _this$sdkConfig$cooki, _this$sdkConfig$cooki2;
+		this.properties = {};
+		eraseCookie(this.PROPS_COOKIE, (_this$sdkConfig$cooki = this.sdkConfig.cookieDomain) !== null && _this$sdkConfig$cooki !== void 0 ? _this$sdkConfig$cooki : null);
+		eraseCookie(this.LEGACY_PROPS_COOKIE, (_this$sdkConfig$cooki2 = this.sdkConfig.cookieDomain) !== null && _this$sdkConfig$cooki2 !== void 0 ? _this$sdkConfig$cooki2 : null);
+	}
+	getProperties() {
+		return this.properties;
+	}
+	_save() {
+		var _this$sdkConfig$cooki3;
+		if (this.sdkConfig.cookiesDisabled) return;
+		setCookie({
+			name: this.PROPS_COOKIE,
+			value: this.b64EncodeUnicode(JSON.stringify(this.properties)),
+			expiresInSeconds: this.expiryDays * ONE_DAY_IN_SECONDS,
+			domain: (_this$sdkConfig$cooki3 = this.sdkConfig.cookieDomain) !== null && _this$sdkConfig$cooki3 !== void 0 ? _this$sdkConfig$cooki3 : null
+		});
+	}
+	b64EncodeUnicode(str) {
+		return btoa(encodeURIComponent(str));
+	}
+	UnicodeDecodeB64(str) {
+		return decodeURIComponent(atob(str));
+	}
+};
+//#endregion
+//#region \0@oxc-project+runtime@0.151.0/helpers/esm/objectWithoutPropertiesLoose.js
+function _objectWithoutPropertiesLoose(r, e) {
+	if (null == r) return {};
+	var t = {};
+	for (var n in r) if ({}.hasOwnProperty.call(r, n)) {
+		if (e.includes(n)) continue;
+		t[n] = r[n];
+	}
+	return t;
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.151.0/helpers/esm/objectWithoutProperties.js
+function _objectWithoutProperties(e, t) {
+	if (null == e) return {};
+	var o, r, i = _objectWithoutPropertiesLoose(e, t);
+	if (Object.getOwnPropertySymbols) {
+		var s = Object.getOwnPropertySymbols(e);
+		for (r = 0; r < s.length; r++) o = s[r], t.includes(o) || {}.propertyIsEnumerable.call(e, o) && (i[o] = e[o]);
+	}
+	return i;
+}
+//#endregion
+//#region src/index.ts
+const _excluded = ["userId"];
+const _excluded2 = [
+	"currency",
+	"event",
+	"channel",
+	"userId"
+];
+const DEFAULT_CONFIG = {
+	cookiesDisabled: false,
+	enableAutoPageviews: true,
+	enableAutoClicks: false,
+	stickyCampaigns: false,
+	consentBehavior: "notRequired",
+	stripQueryParams: false,
+	legacySpaDetection: false,
+	tagPaymentLinks: true,
+	trackAutomatedBrowsers: false
+};
+const MAX_PENDING_EVENTS = 100;
+/** Default reserved event name marking an event as revenue (server-default). */
+const DEFAULT_REVENUE_EVENT_NAME = "Payment";
+const Leapio = () => {
+	let sdkConfig;
+	let disableTracking;
+	let getPageViewPayload;
+	let currentUrl;
+	let currentRef;
+	let identifiedUserId = null;
+	let lastIdentityVerification = null;
+	let anonymousId;
+	let superProperties;
+	let campaign;
+	let consentStore;
+	let consentSourceRegistry = null;
+	let pendingEvents = [];
+	let teardownAutocapture = null;
+	let teardownClassClicks = null;
+	let teardownSpaPageviews = null;
+	let teardownPaymentLinks = null;
+	let engagementTracker = null;
+	let appliedEngagementMode;
+	let appliedAutocaptureKey;
+	let detectedSignals = {};
+	let lastPostedConsentKey = null;
+	let teardownReadyListener = null;
+	let teardownGpp = null;
+	const getStorageOpts = () => {
+		var _sdkConfig$cookieDoma, _sdkConfig$cookieExpi;
+		return {
+			cookiesDisabled: !!(sdkConfig === null || sdkConfig === void 0 ? void 0 : sdkConfig.cookiesDisabled),
+			cookieDomain: (_sdkConfig$cookieDoma = sdkConfig === null || sdkConfig === void 0 ? void 0 : sdkConfig.cookieDomain) !== null && _sdkConfig$cookieDoma !== void 0 ? _sdkConfig$cookieDoma : null,
+			cookieExpirationInSeconds: (_sdkConfig$cookieExpi = sdkConfig === null || sdkConfig === void 0 ? void 0 : sdkConfig.cookieExpirationInSeconds) !== null && _sdkConfig$cookieExpi !== void 0 ? _sdkConfig$cookieExpi : ONE_YEAR_IN_SECONDS
+		};
+	};
+	/** Whether the SDK should hold events until analytics is explicitly granted. */
+	const isExpressMode = () => (sdkConfig === null || sdkConfig === void 0 ? void 0 : sdkConfig.consentBehavior) === "express";
+	/** Whether the SDK sends until analytics is explicitly denied. */
+	const isImpliedMode = () => (sdkConfig === null || sdkConfig === void 0 ? void 0 : sdkConfig.consentBehavior) === "implied";
+	/** Whether an event captured right now would be sent (not queued/dropped). */
+	const canSendNow = () => {
+		var _consentStore$get;
+		const analytics = consentStore === null || consentStore === void 0 || (_consentStore$get = consentStore.get()) === null || _consentStore$get === void 0 ? void 0 : _consentStore$get.categories.analytics;
+		if (isExpressMode()) return analytics === true;
+		if (isImpliedMode()) return analytics !== false;
+		return true;
+	};
+	const consentPostKey = (snapshot) => snapshot ? JSON.stringify({
+		c: snapshot.categories,
+		s: snapshot.signals,
+		src: snapshot.source
+	}) : null;
+	/** Union browser-detected GPC/GPP into the authoritative snapshot. */
+	const mergeDetectedSignalsIntoStore = () => {
+		const current = consentStore === null || consentStore === void 0 ? void 0 : consentStore.get();
+		if (!current || Object.keys(detectedSignals).length === 0) return;
+		const merged = _objectSpread2(_objectSpread2({}, current.signals), detectedSignals);
+		if (JSON.stringify(merged) !== JSON.stringify(current.signals)) consentStore.mergeSnapshot({ signals: merged }, current.source);
+	};
+	/** POST the authoritative snapshot to /consent, deduped on its wire key. */
+	const pushConsentIfChanged = async (verification) => {
+		var _ref;
+		const snapshot = consentStore === null || consentStore === void 0 ? void 0 : consentStore.get();
+		if (!snapshot) return {
+			ok: true,
+			reason: "no_snapshot"
+		};
+		const key = consentPostKey(snapshot);
+		if (key === lastPostedConsentKey) return {
+			ok: true,
+			reason: "unchanged"
+		};
+		const prevKey = lastPostedConsentKey;
+		lastPostedConsentKey = key;
+		const result = await postConsent(sdkConfig, {
+			anonymousId,
+			userId: identifiedUserId,
+			snapshot,
+			identityVerification: (_ref = verification !== null && verification !== void 0 ? verification : lastIdentityVerification) !== null && _ref !== void 0 ? _ref : void 0
+		});
+		if (!result.ok && lastPostedConsentKey === key) lastPostedConsentKey = prevKey;
+		return result;
+	};
+	const init = async (config) => {
+		var _sdkConfig$consentSou;
+		if (typeof window === "undefined") throw new Error("Leapio - script needs access to window object");
+		disableTracking = hasExplicitDNT() || !!config.enableBrowserDNT && hasBrowserDNT() || !config.trackAutomatedBrowsers && isAutomatedBrowser();
+		if (disableTracking) return;
+		sdkConfig = _objectSpread2(_objectSpread2({}, DEFAULT_CONFIG), config);
+		pendingEvents = [];
+		superProperties = new SuperProperties(sdkConfig);
+		campaign = new Campaign(sdkConfig);
+		const { screen: { width, height }, navigator: { language }, location: { hostname, pathname, search, hash }, document } = window;
+		const screen = `${width}x${height}`;
+		currentUrl = `${pathname}${search}${hash}`;
+		currentRef = document.referrer;
+		anonymousId = ensureAnonymousId(getStorageOpts());
+		consentStore = new ConsentStore(getStorageOpts());
+		lastPostedConsentKey = consentPostKey(consentStore.get());
+		detectedSignals = detectPrivacySignals();
+		mergeDetectedSignalsIntoStore();
+		teardownGpp === null || teardownGpp === void 0 || teardownGpp();
+		teardownGpp = subscribeGpp(({ detected, gppString }) => {
+			if (!detected) return;
+			detectedSignals = _objectSpread2(_objectSpread2({}, detectedSignals), {}, { gppDetected: true }, gppString ? { gppString } : {});
+			mergeDetectedSignalsIntoStore();
+		});
+		consentSourceRegistry === null || consentSourceRegistry === void 0 || consentSourceRegistry.stop();
+		consentSourceRegistry = null;
+		const sourceNames = (_sdkConfig$consentSou = sdkConfig.consentSources) !== null && _sdkConfig$consentSou !== void 0 ? _sdkConfig$consentSou : [];
+		if (sourceNames.length > 0) {
+			consentSourceRegistry = new ConsentSourceRegistry(instantiateConsentSources(sourceNames), applyConsentSnapshot);
+			consentSourceRegistry.start();
+		}
+		getPageViewPayload = () => {
+			return {
+				hostname,
+				screen,
+				language
+			};
+		};
+		if (sdkConfig.onLoad) await sdkConfig.onLoad();
+		const normalizeUrl = (href) => {
+			if (href.substring(0, 4) === "http") return "/" + href.split("/").splice(3).join("/");
+			return href;
+		};
+		const handleRouteChange = () => {
+			const nextUrl = normalizeUrl(document.location.href);
+			if (nextUrl === currentUrl) return;
+			engagementTracker === null || engagementTracker === void 0 || engagementTracker.pageChanged();
+			currentRef = currentUrl;
+			currentUrl = nextUrl;
+			if (sdkConfig.enableAutoPageviews) pageview();
+		};
+		/**
+		* SPA route-change detection. Default (History-API): patch `pushState` /
+		* `replaceState` to emit a route-change signal, and listen to `popstate`
+		* (back/forward) + `hashchange` (hash routers). The History-API patches are
+		* restored on teardown. When `legacySpaDetection` is set, fall back to the
+		* old MutationObserver-on-body heuristic instead. Returns a teardown.
+		*/
+		const setupSpaPageviews = () => {
+			if (sdkConfig.legacySpaDetection) {
+				const bodyList = document.querySelector("body");
+				if (!bodyList) return () => {};
+				const observer = new MutationObserver(() => {
+					handleRouteChange();
+				});
+				observer.observe(bodyList, {
+					childList: true,
+					subtree: true
+				});
+				return () => observer.disconnect();
+			}
+			const originalPushState = history.pushState;
+			const originalReplaceState = history.replaceState;
+			const onPopState = () => handleRouteChange();
+			const onHashChange = () => handleRouteChange();
+			const patchedPushState = function(...args) {
+				const result = originalPushState.apply(this, args);
+				handleRouteChange();
+				return result;
+			};
+			const patchedReplaceState = function(...args) {
+				const result = originalReplaceState.apply(this, args);
+				handleRouteChange();
+				return result;
+			};
+			history.pushState = patchedPushState;
+			history.replaceState = patchedReplaceState;
+			window.addEventListener("popstate", onPopState);
+			window.addEventListener("hashchange", onHashChange);
+			return () => {
+				if (history.pushState === patchedPushState) history.pushState = originalPushState;
+				if (history.replaceState === patchedReplaceState) history.replaceState = originalReplaceState;
+				window.removeEventListener("popstate", onPopState);
+				window.removeEventListener("hashchange", onHashChange);
+			};
+		};
+		const update = () => {
+			if (document.readyState === "complete") {
+				if (sdkConfig.enableAutoPageviews) {
+					pageview();
+					if (!teardownSpaPageviews) teardownSpaPageviews = setupSpaPageviews();
+				}
+			}
+		};
+		teardownReadyListener === null || teardownReadyListener === void 0 || teardownReadyListener();
+		document.addEventListener("readystatechange", update, true);
+		teardownReadyListener = () => document.removeEventListener("readystatechange", update, true);
+		update();
+		teardownClassClicks === null || teardownClassClicks === void 0 || teardownClassClicks();
+		teardownClassClicks = listenToClassClicks(({ name }) => {
+			var _sdkConfig$pageviewsC;
+			return track({
+				event: name,
+				channel: (_sdkConfig$pageviewsC = sdkConfig.pageviewsChannel) !== null && _sdkConfig$pageviewsC !== void 0 ? _sdkConfig$pageviewsC : null
+			});
+		});
+		teardownPaymentLinks === null || teardownPaymentLinks === void 0 || teardownPaymentLinks();
+		teardownPaymentLinks = sdkConfig.tagPaymentLinks ? listenForPaymentLinks({
+			getAnonymousId: () => anonymousId,
+			shouldTag: () => !disableTracking && canSendNow()
+		}) : null;
+		applyAutocapture();
+		applyEngagement();
+	};
+	/**
+	* Resolve the engagement mode (snippet ?? dashboard ?? "off") and (re)start
+	* the tracker when it changed. Called on init and after each track response,
+	* like autocapture, so a dashboard change applies without a reload.
+	*/
+	const applyEngagement = () => {
+		var _readRemoteConfig, _sdkConfig$engagement;
+		if (!sdkConfig || disableTracking) return;
+		const remote = (_readRemoteConfig = readRemoteConfig(sdkConfig.publicKey)) === null || _readRemoteConfig === void 0 ? void 0 : _readRemoteConfig.engagement;
+		const mode = (_sdkConfig$engagement = sdkConfig.engagement) !== null && _sdkConfig$engagement !== void 0 ? _sdkConfig$engagement : isEngagementMode(remote) ? remote : "off";
+		if (mode === appliedEngagementMode) return;
+		appliedEngagementMode = mode;
+		engagementTracker === null || engagementTracker === void 0 || engagementTracker.teardown();
+		engagementTracker = mode === "off" ? null : setupEngagement({
+			mode,
+			send: (event, metadata) => {
+				var _sdkConfig$pageviewsC2;
+				track({
+					event,
+					channel: (_sdkConfig$pageviewsC2 = sdkConfig.pageviewsChannel) !== null && _sdkConfig$pageviewsC2 !== void 0 ? _sdkConfig$pageviewsC2 : null,
+					metadata
+				});
+			}
+		});
+	};
+	/**
+	* Compute the effective autocapture config (snippet ?? server ?? default) and
+	* (re)attach the delegated listeners. Idempotent: tears down any existing
+	* listeners first, so it is safe to call again when a fresher server config
+	* arrives on a track response. When autocapture resolves OFF, this leaves no
+	* listeners attached (fail-safe), and core pageview tracking is unaffected.
+	*/
+	const applyAutocapture = () => {
+		if (!sdkConfig || disableTracking) return;
+		const remote = readRemoteConfig(sdkConfig.publicKey);
+		const autocaptureConfig = resolveEffectiveAutocaptureConfig(sdkConfig.autocapture, sdkConfig.enableAutoClicks, remote);
+		const nextKey = JSON.stringify(autocaptureConfig);
+		if (nextKey === appliedAutocaptureKey) return;
+		appliedAutocaptureKey = nextKey;
+		teardownAutocapture === null || teardownAutocapture === void 0 || teardownAutocapture();
+		teardownAutocapture = null;
+		if (autocaptureConfig) teardownAutocapture = setupAutocapture({
+			config: autocaptureConfig,
+			shouldTrack: () => !disableTracking,
+			track: ({ event, metadata }) => {
+				var _sdkConfig$pageviewsC3;
+				return track({
+					event,
+					channel: (_sdkConfig$pageviewsC3 = sdkConfig.pageviewsChannel) !== null && _sdkConfig$pageviewsC3 !== void 0 ? _sdkConfig$pageviewsC3 : null,
+					metadata
+				});
+			}
+		});
+	};
+	const track = async (data) => {
+		var _consentStore$get2;
+		if (!sdkConfig || disableTracking) return;
+		if (!sdkConfig.externalApiUrl && !sdkConfig.publicKey) {
+			console.error("Leapio - SDK not configured. You need to call: leapio.init({publicKey: 'YOUR_PUBLIC_KEY'})");
+			return;
+		}
+		if (data.value != null && data.value !== 0 && !data.currency) console.warn("Leapio - payment sent without a currency. Revenue reports leave it out unless the project counts payments without a currency. Pass currency, e.g. { currency: 'USD' }.");
+		const analytics = consentStore === null || consentStore === void 0 || (_consentStore$get2 = consentStore.get()) === null || _consentStore$get2 === void 0 ? void 0 : _consentStore$get2.categories.analytics;
+		if (isExpressMode()) {
+			if (analytics === true) {
+				await sendEvent(data);
+				return;
+			}
+			if (analytics === false) return;
+			if (pendingEvents.length >= MAX_PENDING_EVENTS) pendingEvents.shift();
+			pendingEvents.push(_objectSpread2(_objectSpread2({}, data), {}, {
+				url: currentUrl,
+				referrer: currentRef,
+				anonymousId
+			}));
+			return;
+		}
+		if (isImpliedMode() && analytics === false) return;
+		await sendEvent(data);
+	};
+	/**
+	* Compute the observed snippet-override report to attach to the next track
+	* request, if any. Derives the EXPLICIT snippet override set from the same
+	* normalization the autocapture resolver uses, then defers to the localStorage
+	* dedup in `ac-overrides.ts`: returns a report only when the override set
+	* differs from the last one reported for this public key (or, in the CLEAR
+	* case, once after the overrides are removed). Best-effort — any failure
+	* yields null so tracking is never affected.
+	*/
+	const computeAcOverridesReport = () => {
+		try {
+			const normalized = normalizeSnippet(sdkConfig.autocapture);
+			const report = buildSnippetOverrideReport(normalized, sdkConfig.enableAutoClicks);
+			let url = null;
+			try {
+				const href = window.location.href;
+				url = href ? href.split("#")[0] : null;
+				if (url && sdkConfig.stripQueryParams) {
+					var _stripUrl;
+					url = (_stripUrl = stripUrl(url, sdkConfig.queryParamAllowlist)) !== null && _stripUrl !== void 0 ? _stripUrl : url;
+				}
+			} catch (_unused) {
+				url = null;
+			}
+			return resolveAcOverridesToReport({
+				publicKey: sdkConfig.publicKey,
+				report,
+				url
+			});
+		} catch (_unused2) {
+			return null;
+		}
+	};
+	/**
+	* Build the wire payload for one event and send it, stamping the current
+	* consent snapshot. Shared by `track()` and the express-mode flush.
+	*/
+	const sendEvent = async (data) => {
+		var _data$url, _ref2, _ref3, _data$userId, _data$anonymousId, _data$referrer, _data$metadata, _consentStore$get3;
+		const payload = getPageViewPayload();
+		const _superProperties$getP = superProperties.getProperties(), { userId: propsUserId } = _superProperties$getP, props = _objectWithoutProperties(_superProperties$getP, _excluded);
+		const campaignParams = campaign.getCampaignParams();
+		const cleanedUrl = removeQueryParamsFromUrl((_data$url = data.url) !== null && _data$url !== void 0 ? _data$url : currentUrl, CAMPAIGN_KEYWORDS);
+		const resolvedUserId = (_ref2 = (_ref3 = (_data$userId = data.userId) !== null && _data$userId !== void 0 ? _data$userId : propsUserId ? `${propsUserId}` : null) !== null && _ref3 !== void 0 ? _ref3 : identifiedUserId) !== null && _ref2 !== void 0 ? _ref2 : null;
+		await trackEvent(sdkConfig, {
+			event: data.event,
+			channel: data.channel,
+			message: data.message,
+			notify: data.notify,
+			userId: resolvedUserId,
+			anonymousId: (_data$anonymousId = data.anonymousId) !== null && _data$anonymousId !== void 0 ? _data$anonymousId : anonymousId,
+			groupId: data.groupId,
+			groupType: data.groupType,
+			hostname: payload.hostname,
+			language: payload.language,
+			referrer: (_data$referrer = data.referrer) !== null && _data$referrer !== void 0 ? _data$referrer : currentRef,
+			screen: payload.screen,
+			url: cleanedUrl,
+			value: data.value,
+			currency: data.currency,
+			metadata: _objectSpread2(_objectSpread2(_objectSpread2({}, campaignParams), props), (_data$metadata = data.metadata) !== null && _data$metadata !== void 0 ? _data$metadata : {})
+		}, (_consentStore$get3 = consentStore === null || consentStore === void 0 ? void 0 : consentStore.get()) !== null && _consentStore$get3 !== void 0 ? _consentStore$get3 : null, computeAcOverridesReport());
+		applyAutocapture();
+		applyEngagement();
+	};
+	/**
+	* Flush the express-mode queue once a snapshot is known. If analytics is
+	* explicitly denied in the snapshot, drop the queue instead (the server is
+	* the enforcement backstop, but we avoid sending events we know will be
+	* dropped). Called after any snapshot change.
+	*/
+	const flushPendingEvents = async () => {
+		if (!pendingEvents.length) return;
+		const queued = pendingEvents;
+		pendingEvents = [];
+		for (let i = 0; i < queued.length; i++) {
+			var _consentStore$get4;
+			const analytics = consentStore === null || consentStore === void 0 || (_consentStore$get4 = consentStore.get()) === null || _consentStore$get4 === void 0 ? void 0 : _consentStore$get4.categories.analytics;
+			if (analytics === true) await sendEvent(queued[i]);
+			else if (analytics === false) return;
+			else {
+				pendingEvents.push(...queued.slice(i));
+				return;
+			}
+		}
+	};
+	/**
+	* Public API: track a revenue event. Thin wrapper over `track()` that emits
+	* the reserved revenue event name (default "Payment") with the monetary
+	* `value` (MAJOR units, e.g. dollars) and ISO-4217 `currency`. Any other
+	* options become event metadata (e.g. product, plan, interval, quantity).
+	*
+	* For Stripe attribution, pass `leapio.getAnonymousId()` (or the
+	* `leapio_anonymous_id` cookie) into your Stripe Checkout session metadata as
+	* `leapio_anonymous_id` so the connected-account webhook can link the payment
+	* back to this visitor.
+	*/
+	const revenue = async (amount, options = {}) => {
+		if (!sdkConfig || disableTracking) return;
+		if (typeof amount !== "number" || !isFinite(amount) || amount < 0) {
+			console.error("Leapio - revenue() requires a finite, non-negative amount");
+			return;
+		}
+		const { currency, event, channel, userId } = options, metadata = _objectWithoutProperties(options, _excluded2);
+		await track({
+			event: event !== null && event !== void 0 ? event : DEFAULT_REVENUE_EVENT_NAME,
+			channel,
+			userId,
+			value: amount,
+			currency,
+			metadata
+		});
+	};
+	const pageview = async (data) => {
+		var _sdkConfig$pageviewsC4;
+		if (!sdkConfig || disableTracking) return;
+		await track({
+			event: "Pageview",
+			channel: (_sdkConfig$pageviewsC4 = sdkConfig.pageviewsChannel) !== null && _sdkConfig$pageviewsC4 !== void 0 ? _sdkConfig$pageviewsC4 : null,
+			userId: data === null || data === void 0 ? void 0 : data.userId,
+			metadata: data === null || data === void 0 ? void 0 : data.metadata
+		});
+	};
+	const register = (properties) => {
+		if (!sdkConfig || disableTracking) return true;
+		return superProperties.register(properties);
+	};
+	const getProperties = () => {
+		if (!sdkConfig || disableTracking) return {};
+		return superProperties.getProperties();
+	};
+	const unregister = (property) => {
+		if (!sdkConfig || disableTracking) return;
+		superProperties.unregister(property);
+	};
+	const identify = async (newUserId, traits, opts) => {
+		var _consentStore$get5;
+		if (!sdkConfig) {
+			console.warn("Leapio - identify() called before init()");
+			return {
+				ok: false,
+				reason: "not_initialized"
+			};
+		}
+		if (disableTracking) return {
+			ok: false,
+			reason: "tracking_disabled"
+		};
+		const normalizedUserId = `${newUserId !== null && newUserId !== void 0 ? newUserId : ""}`.trim();
+		if (!normalizedUserId) {
+			console.error("Leapio - identify requires a userId");
+			return {
+				ok: false,
+				reason: "missing_user_id"
+			};
+		}
+		const firstTouch = sanitizeFirstTouch(campaign.getFirstTouchParams());
+		const mergedTraits = Object.keys(firstTouch).length > 0 ? _objectSpread2({ first_touch: firstTouch }, traits) : traits;
+		const result = await identifyUser(sdkConfig, {
+			anonymousId,
+			userId: normalizedUserId,
+			traits: mergedTraits,
+			options: opts
+		}, (_consentStore$get5 = consentStore === null || consentStore === void 0 ? void 0 : consentStore.get()) !== null && _consentStore$get5 !== void 0 ? _consentStore$get5 : null);
+		if (result.ok) {
+			var _opts$identityVerific;
+			identifiedUserId = normalizedUserId;
+			lastIdentityVerification = (_opts$identityVerific = opts === null || opts === void 0 ? void 0 : opts.identityVerification) !== null && _opts$identityVerific !== void 0 ? _opts$identityVerific : null;
+			superProperties.register({ userId: identifiedUserId });
+		}
+		return result;
+	};
+	/**
+	* Associate the current visitor with a group/account (Segment `group()`), e.g.
+	* a company. Binds to the identified `user_id` when known, otherwise to the
+	* managed `anonymousId` (the platform promotes anon memberships to the identity
+	* on the next identify). Not gated on consent: a customer-directed linkage call
+	* (legitimate interest); the server gates egress by purpose.
+	*/
+	const group = async (groupId, traits, opts) => {
+		if (!sdkConfig) {
+			console.warn("Leapio - group() called before init()");
+			return {
+				ok: false,
+				reason: "not_initialized"
+			};
+		}
+		if (disableTracking) return {
+			ok: false,
+			reason: "tracking_disabled"
+		};
+		const normalizedGroupId = `${groupId !== null && groupId !== void 0 ? groupId : ""}`.trim();
+		if (!normalizedGroupId) {
+			console.error("Leapio - group requires a groupId");
+			return {
+				ok: false,
+				reason: "missing_group_id"
+			};
+		}
+		return groupUser(sdkConfig, {
+			anonymousId,
+			userId: identifiedUserId,
+			groupId: normalizedGroupId,
+			type: opts === null || opts === void 0 ? void 0 : opts.type,
+			traits,
+			options: opts
+		});
+	};
+	/** Apply the url-privacy toggle to first-touch urls before they egress. */
+	const sanitizeFirstTouch = (firstTouch) => {
+		if (!(sdkConfig === null || sdkConfig === void 0 ? void 0 : sdkConfig.stripQueryParams)) return firstTouch;
+		const sanitized = _objectSpread2({}, firstTouch);
+		for (const key of ["landing_url", "referrer"]) if (sanitized[key]) {
+			var _stripUrl2;
+			sanitized[key] = (_stripUrl2 = stripUrl(sanitized[key], sdkConfig.queryParamAllowlist)) !== null && _stripUrl2 !== void 0 ? _stripUrl2 : sanitized[key];
+		}
+		return sanitized;
+	};
+	/**
+	* Internal: apply a snapshot from a consent source through the store's
+	* priority-aware `applySnapshot`. If accepted (became/stayed authoritative),
+	* persists, flushes any express-mode queue, and pushes to `/consent`.
+	*
+	* This is the internal seam the consent-source plugins write through: a
+	* source (Concord/OneTrust/GCM reader/...) constructs a
+	* `ConsentSnapshot` with its `source` id and calls this; the store keeps the
+	* highest-priority snapshot authoritative.
+	*
+	* Returns `true` if the snapshot was accepted, `false` if a higher-priority
+	* source already owns the state.
+	*/
+	const applyConsentSnapshot = async (snapshot) => {
+		if (!sdkConfig || disableTracking || !consentStore) return false;
+		if (!consentStore.applySnapshot(snapshot)) return false;
+		mergeDetectedSignalsIntoStore();
+		await flushPendingEvents();
+		await pushConsentIfChanged();
+		return true;
+	};
+	/**
+	* Public API: explicit consent (highest-priority source `leapio_api`).
+	* Merge-partial update — unspecified categories keep their prior value.
+	* Persists, stamps subsequent events, flushes the express queue, and POSTs
+	* the new state to `/consent`.
+	*/
+	const setConsent = async (input, opts) => {
+		if (!sdkConfig) {
+			console.warn("Leapio - setConsent() called before init()");
+			return {
+				ok: false,
+				reason: "not_initialized"
+			};
+		}
+		if (disableTracking) return {
+			ok: false,
+			reason: "tracking_disabled"
+		};
+		const categories = {};
+		if (typeof input.analytics === "boolean") categories.analytics = input.analytics;
+		if (typeof input.functional === "boolean") categories.functional = input.functional;
+		if (typeof input.marketing === "boolean") categories.marketing = input.marketing;
+		const signals = typeof input.doNotSellShare === "boolean" ? { doNotSellShare: input.doNotSellShare } : {};
+		consentStore.mergeSnapshot({
+			categories,
+			signals
+		}, "leapio_api");
+		mergeDetectedSignalsIntoStore();
+		await flushPendingEvents();
+		return pushConsentIfChanged(opts === null || opts === void 0 ? void 0 : opts.identityVerification);
+	};
+	/** Public API: read the current consent snapshot (or null if none yet). */
+	const getConsent = () => {
+		if (!sdkConfig || disableTracking || !consentStore) return null;
+		return consentStore.get();
+	};
+	const reset = () => {
+		var _sdkConfig$consentSou2;
+		if (!sdkConfig || disableTracking) return;
+		superProperties.clear();
+		identifiedUserId = null;
+		lastIdentityVerification = null;
+		anonymousId = rotateAnonymousId(getStorageOpts());
+		consentStore === null || consentStore === void 0 || consentStore.clear();
+		pendingEvents = [];
+		lastPostedConsentKey = null;
+		consentSourceRegistry === null || consentSourceRegistry === void 0 || consentSourceRegistry.stop();
+		consentSourceRegistry = null;
+		const sourceNames = (_sdkConfig$consentSou2 = sdkConfig.consentSources) !== null && _sdkConfig$consentSou2 !== void 0 ? _sdkConfig$consentSou2 : [];
+		if (sourceNames.length > 0) {
+			consentSourceRegistry = new ConsentSourceRegistry(instantiateConsentSources(sourceNames), applyConsentSnapshot);
+			consentSourceRegistry.start();
+		}
+	};
+	/**
+	* The current anonymous visitor id. This is the value to pass into your
+	* Stripe Checkout session metadata as `leapio_anonymous_id` (it mirrors the
+	* `leapio_anonymous_id` cookie) so Leapio's connected-account webhook can
+	* attribute the resulting payment back to this visitor and their account.
+	* Returns null when tracking is disabled or the SDK is not initialized.
+	*/
+	const getAnonymousId = () => {
+		if (!sdkConfig || disableTracking) return null;
+		return anonymousId;
+	};
+	return {
+		init,
+		track,
+		revenue,
+		pageview,
+		register,
+		unregister,
+		reset,
+		identify,
+		group,
+		setConsent,
+		getConsent,
+		applyConsentSnapshot,
+		getProperties,
+		getAnonymousId
+	};
+};
+const leapio = Leapio();
+//#endregion
+export { DEFAULT_QUERY_PARAM_ALLOWLIST, leapio as default, leapio };