@owlmeans/consent 0.1.18-rc.10

package/build/i18n/fr.json

@@ -0,0 +1,36 @@
+{
+    "title": "Préférences de cookies",
+    "description": "Nous utilisons des cookies pour améliorer votre navigation, proposer des publicités ou contenus personnalisés et analyser notre trafic. En cliquant sur « Tout accepter », vous consentez à leur utilisation.",
+    "essential": "Cookies essentiels",
+    "essentialDesc": "Nécessaires au fonctionnement du site : connexion, sécurité et mémorisation de vos choix en matière de cookies et de la langue de l'interface. Ils ne peuvent pas être désactivés.",
+    "analytics": "Cookies analytiques",
+    "analyticsDesc": "Nous aident à améliorer notre site en recueillant et en analysant des informations sur son utilisation.",
+    "marketing": "Cookies marketing",
+    "marketingDesc": "Utilisés pour suivre les visiteurs entre les sites et afficher des publicités pertinentes.",
+    "required": "Requis",
+    "acceptAll": "Tout accepter",
+    "acceptAndContinue": "Accepter et continuer",
+    "savePreferences": "Enregistrer les préférences",
+    "policyLink": "Politique relative aux cookies",
+    "openPreferences": "Préférences de cookies",
+    "close": "Fermer",
+    "loginReason": "La connexion enregistre un cookie de session. Acceptez les cookies essentiels pour continuer.",
+    "manage": "Gérer les préférences",
+    "policyTitle": "Politique relative aux cookies",
+    "policyIntro": "Cette page décrit les cookies et stockages similaires utilisés par cette application, ainsi que la façon de les contrôler.",
+    "policyStorage": "Votre choix est enregistré dans ce navigateur sous « {{key}} », dans le stockage local et dans un cookie.",
+    "policyRetention": "Ce choix est conservé {{days}} jours, après quoi il vous sera demandé de nouveau.",
+    "policyOperator": "Cette application est exploitée par {{operator}}.",
+    "policyContact": "Consultez leur politique de confidentialité et leurs conditions pour savoir comment vos données sont traitées.",
+    "policyServicesOf": "Services — {{category}}",
+    "policyOtherServices": "Autres services",
+    "policyOtherServicesDesc": "Services utilisés par cette application en dehors des catégories ci-dessus.",
+    "policyProvider": "Fournisseur",
+    "policyPurpose": "Finalité",
+    "policyCookies": "Cookies",
+    "policyServicePrivacy": "Politique de confidentialité de {{provider}}",
+    "privacy": "Politique de confidentialité",
+    "terms": "Conditions générales",
+    "domains": "Ce choix s'applique à {{domains}}.",
+    "policyDomains": "Ce choix s'applique aux domaines suivants :"
+}

package/build/i18n/pl.json

@@ -0,0 +1,36 @@
+{
+    "title": "Preferencje dotyczące plików cookie",
+    "description": "Używamy plików cookie w celu ulepszenia Twojego doświadczenia podczas przeglądania, wyświetlania spersonalizowanych reklam lub treści oraz analizowania naszego ruchu. Klikając „Akceptuj wszystkie\", wyrażasz zgodę na używanie przez nas plików cookie.",
+    "essential": "Niezbędne pliki cookie",
+    "essentialDesc": "Wymagane do działania witryny — logowanie, bezpieczeństwo oraz zapamiętanie Twoich wyborów dotyczących plików cookie i języka interfejsu. Nie można ich wyłączyć.",
+    "analytics": "Analityczne pliki cookie",
+    "analyticsDesc": "Pomagają nam ulepszać naszą witrynę internetową, zbierając i raportując informacje o jej użytkowaniu.",
+    "marketing": "Marketingowe pliki cookie",
+    "marketingDesc": "Służą do śledzenia odwiedzających na różnych stronach internetowych w celu wyświetlania trafnych reklam, dostosowanych do konkretnego użytkownika.",
+    "required": "Wymagane",
+    "acceptAll": "Akceptuj wszystkie",
+    "acceptAndContinue": "Akceptuj i kontynuuj",
+    "savePreferences": "Zapisz preferencje",
+    "policyLink": "Polityka plików cookie",
+    "openPreferences": "Preferencje plików cookie",
+    "close": "Zamknij",
+    "loginReason": "Logowanie zapisuje plik cookie sesji. Zaakceptuj niezbędne pliki cookie, aby kontynuować.",
+    "manage": "Zarządzaj preferencjami",
+    "policyTitle": "Polityka plików cookie",
+    "policyIntro": "Ta strona opisuje pliki cookie i podobne mechanizmy przechowywania używane przez tę aplikację oraz sposób ich kontrolowania.",
+    "policyStorage": "Twój wybór jest zapisywany w tej przeglądarce pod kluczem „{{key}}\" — zarówno w pamięci lokalnej, jak i w pliku cookie.",
+    "policyRetention": "Zapis jest przechowywany przez {{days}} dni, po czym zapytamy ponownie.",
+    "policyOperator": "Tę aplikację prowadzi {{operator}}.",
+    "policyContact": "Zapoznaj się z ich polityką prywatności i regulaminem, aby dowiedzieć się, jak przetwarzają Twoje dane.",
+    "policyServicesOf": "Usługi — {{category}}",
+    "policyOtherServices": "Inne usługi",
+    "policyOtherServicesDesc": "Usługi, z których ta aplikacja korzysta poza powyższymi kategoriami.",
+    "policyProvider": "Dostawca",
+    "policyPurpose": "Cel",
+    "policyCookies": "Pliki cookie",
+    "policyServicePrivacy": "Polityka prywatności: {{provider}}",
+    "privacy": "Polityka prywatności",
+    "terms": "Regulamin",
+    "domains": "Ten wybór dotyczy: {{domains}}.",
+    "policyDomains": "Ten wybór dotyczy następujących domen:"
+}

package/build/i18n/ru.json

@@ -0,0 +1,36 @@
+{
+    "title": "Настройки файлов cookie",
+    "description": "Мы используем файлы cookie, чтобы улучшить ваш опыт просмотра, показывать персонализированную рекламу или контент и анализировать наш трафик. Нажимая «Принять все», вы соглашаетесь на использование файлов cookie.",
+    "essential": "Необходимые файлы cookie",
+    "essentialDesc": "Нужны для работы сайта — вход, безопасность и сохранение вашего выбора по файлам cookie и языка интерфейса. Их нельзя отключить.",
+    "analytics": "Аналитические файлы cookie",
+    "analyticsDesc": "Помогают нам улучшать наш сайт, собирая и предоставляя информацию о его использовании.",
+    "marketing": "Маркетинговые файлы cookie",
+    "marketingDesc": "Используются для отслеживания посетителей на разных сайтах для показа релевантной и интересной рекламы.",
+    "required": "Обязательно",
+    "acceptAll": "Принять все",
+    "acceptAndContinue": "Принять и продолжить",
+    "savePreferences": "Сохранить настройки",
+    "policyLink": "Политика использования файлов cookie",
+    "openPreferences": "Настройки файлов cookie",
+    "close": "Закрыть",
+    "loginReason": "Вход сохраняет сессионный файл cookie. Примите необходимые файлы cookie, чтобы продолжить.",
+    "manage": "Изменить настройки",
+    "policyTitle": "Политика использования файлов cookie",
+    "policyIntro": "На этой странице описаны файлы cookie и подобные хранилища, которые использует это приложение, и как ими управлять.",
+    "policyStorage": "Ваш выбор сохраняется в этом браузере под ключом «{{key}}» — и в локальном хранилище, и в файле cookie.",
+    "policyRetention": "Запись хранится {{days}} дней, после чего мы спросим снова.",
+    "policyOperator": "Это приложение принадлежит {{operator}}.",
+    "policyContact": "Ознакомьтесь с их политикой конфиденциальности и условиями использования, чтобы узнать, как они обрабатывают ваши данные.",
+    "policyServicesOf": "Сервисы — {{category}}",
+    "policyOtherServices": "Другие сервисы",
+    "policyOtherServicesDesc": "Сервисы, которые это приложение использует вне перечисленных выше категорий.",
+    "policyProvider": "Поставщик",
+    "policyPurpose": "Цель",
+    "policyCookies": "Файлы cookie",
+    "policyServicePrivacy": "Политика конфиденциальности: {{provider}}",
+    "privacy": "Политика конфиденциальности",
+    "terms": "Условия использования",
+    "domains": "Этот выбор применяется к {{domains}}.",
+    "policyDomains": "Этот выбор применяется к следующим доменам:"
+}

package/build/i18n/uk.json

@@ -0,0 +1,36 @@
+{
+    "title": "Налаштування файлів cookie",
+    "description": "Ми використовуємо файли cookie, щоб покращити ваш досвід перегляду, показувати персоналізовану рекламу чи вміст і аналізувати наш трафік. Натискаючи «Прийняти всі», ви погоджуєтеся на використання файлів cookie.",
+    "essential": "Необхідні файли cookie",
+    "essentialDesc": "Потрібні для роботи сайту — вхід, безпека та збереження вашого вибору щодо файлів cookie і мови інтерфейсу. Їх не можна вимкнути.",
+    "analytics": "Аналітичні файли cookie",
+    "analyticsDesc": "Допомагають нам покращувати наш вебсайт, збираючи та надаючи інформацію про його використання.",
+    "marketing": "Маркетингові файли cookie",
+    "marketingDesc": "Використовуються для відстеження відвідувачів на різних вебсайтах для показу релевантної та цікавої реклами.",
+    "required": "Обов'язково",
+    "acceptAll": "Прийняти всі",
+    "acceptAndContinue": "Прийняти й продовжити",
+    "savePreferences": "Зберегти налаштування",
+    "policyLink": "Політика щодо файлів cookie",
+    "openPreferences": "Налаштування файлів cookie",
+    "close": "Закрити",
+    "loginReason": "Вхід зберігає сеансовий файл cookie. Прийміть необхідні файли cookie, щоб продовжити.",
+    "manage": "Змінити налаштування",
+    "policyTitle": "Політика щодо файлів cookie",
+    "policyIntro": "Ця сторінка описує файли cookie та подібні сховища, які використовує цей застосунок, і як ними керувати.",
+    "policyStorage": "Ваш вибір зберігається в цьому браузері під ключем «{{key}}» — і в локальному сховищі, і у файлі cookie.",
+    "policyRetention": "Запис зберігається {{days}} днів, після чого ми запитаємо знову.",
+    "policyOperator": "Цей застосунок належить {{operator}}.",
+    "policyContact": "Ознайомтеся з їхньою політикою конфіденційності та умовами користування, щоб дізнатися, як вони обробляють ваші дані.",
+    "policyServicesOf": "Сервіси — {{category}}",
+    "policyOtherServices": "Інші сервіси",
+    "policyOtherServicesDesc": "Сервіси, які цей застосунок використовує поза переліченими вище категоріями.",
+    "policyProvider": "Постачальник",
+    "policyPurpose": "Мета",
+    "policyCookies": "Файли cookie",
+    "policyServicePrivacy": "Політика конфіденційності: {{provider}}",
+    "privacy": "Політика конфіденційності",
+    "terms": "Умови користування",
+    "domains": "Цей вибір застосовується до {{domains}}.",
+    "policyDomains": "Цей вибір застосовується до таких доменів:"
+}

package/build/i18n.d.ts

@@ -0,0 +1,16 @@
+import type { ConsentLocale } from './types.js';
+/**
+ * The dialog's copy, in the box.
+ *
+ * Carried here rather than registered into an i18n framework because one of the three consumers is
+ * an Astro site with React islands and no OwlMeans i18n at all — and a consent dialog that renders
+ * raw keys is worse than no dialog. An application that HAS translations passes `translate` and
+ * overrides every one of these.
+ */
+export declare const DEFAULT_CONSENT_MESSAGES: Record<ConsentLocale, Record<string, string>>;
+export declare const normalizeLocale: (locale?: string) => ConsentLocale;
+/** `(key, defaultValue) => string`, the house shape, backed by the built-in bundle. */
+export declare const defaultConsentTranslate: (locale?: string) => (key: string, defaultValue: string) => string;
+/** Substitute `{{name}}` placeholders. Enough for the two the policy page needs. */
+export declare const interpolate: (text: string, values: Record<string, string | number>) => string;
+//# sourceMappingURL=i18n.d.ts.map

package/build/i18n.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"i18n.d.ts","sourceRoot":"","sources":["../src/i18n.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAW/C;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAElF,CAAA;AAED,eAAO,MAAM,eAAe,YAAa,MAAM,KAAG,aAIjD,CAAA;AAED,uFAAuF;AACvF,eAAO,MAAM,uBAAuB,YAAa,MAAM,WAC/C,MAAM,gBAAgB,MAAM,KAAG,MACqC,CAAA;AAE5E,oFAAoF;AACpF,eAAO,MAAM,WAAW,SAAU,MAAM,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,KAAG,MAE5B,CAAA"}

package/build/i18n.js

@@ -0,0 +1,29 @@
+import { CONSENT_LOCALES } from './consts.js';
+import en from './i18n/en.json' with { type: 'json' };
+import pl from './i18n/pl.json' with { type: 'json' };
+import ru from './i18n/ru.json' with { type: 'json' };
+import be from './i18n/be.json' with { type: 'json' };
+import uk from './i18n/uk.json' with { type: 'json' };
+import es from './i18n/es.json' with { type: 'json' };
+import de from './i18n/de.json' with { type: 'json' };
+import fr from './i18n/fr.json' with { type: 'json' };
+/**
+ * The dialog's copy, in the box.
+ *
+ * Carried here rather than registered into an i18n framework because one of the three consumers is
+ * an Astro site with React islands and no OwlMeans i18n at all — and a consent dialog that renders
+ * raw keys is worse than no dialog. An application that HAS translations passes `translate` and
+ * overrides every one of these.
+ */
+export const DEFAULT_CONSENT_MESSAGES = {
+    en, pl, ru, be, uk, es, de, fr,
+};
+export const normalizeLocale = (locale) => {
+    const base = (locale ?? 'en').toLowerCase().split('-')[0];
+    return CONSENT_LOCALES.includes(base) ? base : 'en';
+};
+/** `(key, defaultValue) => string`, the house shape, backed by the built-in bundle. */
+export const defaultConsentTranslate = (locale) => (key, defaultValue) => DEFAULT_CONSENT_MESSAGES[normalizeLocale(locale)]?.[key] ?? defaultValue;
+/** Substitute `{{name}}` placeholders. Enough for the two the policy page needs. */
+export const interpolate = (text, values) => text.replace(/\{\{([a-z]+)\}\}/gi, (whole, name) => values[name] != null ? String(values[name]) : whole);
+//# sourceMappingURL=i18n.js.map

package/build/i18n.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"i18n.js","sourceRoot":"","sources":["../src/i18n.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAG7C,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AAErD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAkD;IACrF,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;CAC/B,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAe,EAAiB,EAAE;IAChE,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IAEzD,OAAO,eAAe,CAAC,QAAQ,CAAC,IAAqB,CAAC,CAAC,CAAC,CAAC,IAAqB,CAAC,CAAC,CAAC,IAAI,CAAA;AACvF,CAAC,CAAA;AAED,uFAAuF;AACvF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAe,EAAE,EAAE,CACzD,CAAC,GAAW,EAAE,YAAoB,EAAU,EAAE,CAC5C,wBAAwB,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,YAAY,CAAA;AAE5E,oFAAoF;AACpF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,MAAuC,EAAU,EAAE,CAC3F,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE,CACzD,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA"}

package/build/index.d.ts

@@ -0,0 +1,12 @@
+export type * from './types.js';
+export * from './consts.js';
+export * from './storage.js';
+export * from './gtm.js';
+export * from './store.js';
+export * from './i18n.js';
+export type { ConsentPlugin } from './types.js';
+export { registerConsentPlugin, consentPlugins, decorateConsentUrl, consentDomains, adoptConsent, startConsentPlugins, adoptConsentLanguage, } from './plugins.js';
+export type { ConsentLinkPayload } from './types.js';
+export { consentLinker, encodeConsentLink, decodeConsentLink, stripConsentLinkParam, consentLinkerScript, writeConsentLanguage } from './linker.js';
+export { CONSENT_LINK_PARAM, CONSENT_LINK_MAX_AGE, CONSENT_LINK_SKEW } from './consts.js';
+//# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,UAAU,CAAA;AACxB,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EACL,qBAAqB,EAAE,cAAc,EAAE,kBAAkB,EAAE,cAAc,EAAE,YAAY,EACvF,mBAAmB,EAAE,oBAAoB,GAC1C,MAAM,cAAc,CAAA;AACrB,YAAY,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AACpD,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACnJ,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA"}

package/build/index.js

@@ -0,0 +1,9 @@
+export * from './consts.js';
+export * from './storage.js';
+export * from './gtm.js';
+export * from './store.js';
+export * from './i18n.js';
+export { registerConsentPlugin, consentPlugins, decorateConsentUrl, consentDomains, adoptConsent, startConsentPlugins, adoptConsentLanguage, } from './plugins.js';
+export { consentLinker, encodeConsentLink, decodeConsentLink, stripConsentLinkParam, consentLinkerScript, writeConsentLanguage } from './linker.js';
+export { CONSENT_LINK_PARAM, CONSENT_LINK_MAX_AGE, CONSENT_LINK_SKEW } from './consts.js';
+//# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,UAAU,CAAA;AACxB,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AAEzB,OAAO,EACL,qBAAqB,EAAE,cAAc,EAAE,kBAAkB,EAAE,cAAc,EAAE,YAAY,EACvF,mBAAmB,EAAE,oBAAoB,GAC1C,MAAM,cAAc,CAAA;AAErB,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACnJ,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA"}

package/build/linker.d.ts

@@ -0,0 +1,55 @@
+import type { ConsentPlugin, ConsentOptions, ConsentRecord, ConsentLinkPayload } from './types.js';
+/**
+ * The link parameter's value: the current document's decision as `c` (one `0`/`1` per optional
+ * category — empty while `record` is `null`, i.e. before the visitor has decided) and, when
+ * `opts.linker.language` is set, the page's language as `l`.
+ */
+export declare const encodeConsentLink: (record: ConsentRecord | null, opts?: ConsentOptions) => string;
+/** Parse-only — no trust decision here, that is `consentLinker(opts).adopt`'s job. Never throws. */
+export declare const decodeConsentLink: (value: string) => ConsentLinkPayload | null;
+/**
+ * Persist an adopted language where the application's i18n layer reads its explicit choice from —
+ * `linker.language.storageKey`, `owlmeans-lng` by default. Unconditional: the interface language is
+ * strictly necessary storage (the visitor picked it, and the site cannot speak to them without it),
+ * so no cookie decision — none yet, a refusal, an old record — stands between it and the device.
+ *
+ * It overwrites what is there on purpose: the carried language is the one the visitor was reading a
+ * moment ago, which outranks a choice they made on this domain some other day. Storage that refuses
+ * the write is not an error. Returns whether the language was written.
+ */
+export declare const writeConsentLanguage: (language: string, opts?: ConsentOptions) => boolean;
+/**
+ * Cross-domain consent: share this decision, and adopt one, between the domains named in
+ * `opts.linker.domains`.
+ *
+ * `start` decorates outgoing first-party links; `adopt` reads and validates an incoming one;
+ * `domains` discloses the list a dialog or policy page names. `decorate` is generic (a bare `URL`,
+ * no DOM) so the same trust rule serves a real anchor click and a programmatic navigation
+ * (`decorateConsentUrl`) alike — the `rel="noreferrer"` exemption is a DOM-only concept and is
+ * therefore checked by `start`'s click handler, never here.
+ */
+export declare const consentLinker: () => ConsentPlugin;
+/**
+ * Remove the link parameter from the visible URL, keeping every other parameter and the hash — the
+ * real-TS equivalent of what {@link consentLinkerScript}'s embedded fragment already did inline.
+ * Idempotent: a page with no head script calls this from `consentStore.init` and it strips once; a
+ * page that ALSO carried the head script finds the parameter already gone and does nothing.
+ */
+export declare const stripConsentLinkParam: (opts: ConsentOptions) => void;
+/**
+ * The inline `<head>` fragment that adopts a decorated link's decision and strips the parameter —
+ * standalone, so a page can stamp it even where nothing else here runs (a legal page with no tag
+ * script). `@owlmeans/web-gtm`'s `consentBootstrapScript` embeds this SAME fragment right after
+ * pushing Consent Mode's defaults, so a page that has both never runs it twice with different
+ * effect — the second attempt finds the parameter already gone and does nothing.
+ *
+ * Mirrors `consentLinker().adopt` exactly (v2, referrer + freshness/skew + full optional coverage +
+ * no existing record), but as hand-rolled JS text rather than a call into this module — the same
+ * discipline `consentBootstrapScript`/`consentGateScript` already follow, because this has to run
+ * before any bundle (this module included) has loaded. The parameter is ALWAYS stripped via
+ * `history.replaceState`, whether or not the trust rule accepts it: a stale or foreign `owlcc` is
+ * exactly as much noise as an adopted one, and neither belongs in the visible URL or in what a page
+ * reload, a shared link or a browser history entry carries forward.
+ */
+export declare const consentLinkerScript: (opts: ConsentOptions) => string;
+//# sourceMappingURL=linker.d.ts.map

package/build/linker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"linker.d.ts","sourceRoot":"","sources":["../src/linker.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAmB,cAAc,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAsCnH;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,WAAY,aAAa,GAAG,IAAI,SAAS,cAAc,KAAG,MAavF,CAAA;AAED,oGAAoG;AACpG,eAAO,MAAM,iBAAiB,UAAW,MAAM,KAAG,kBAAkB,GAAG,IAuBtE,CAAA;AAyDD;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,aAAc,MAAM,SAAS,cAAc,KAAG,OAS9E,CAAA;AAQD;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa,QAAO,aA2FhC,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,SAAU,cAAc,KAAG,IAgB5D,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,SAAU,cAAc,KAAG,MA2D1D,CAAA"}

package/build/linker.js

@@ -0,0 +1,334 @@
+import { CONSENT_COOKIE_DAYS, CONSENT_KEY, CONSENT_LANGUAGE_KEY, CONSENT_SCHEMA_VERSION, DEFAULT_CONSENT_CATEGORIES, CONSENT_LINK_MAX_AGE, CONSENT_LINK_PARAM, CONSENT_LINK_SKEW } from './consts.js';
+import { decorateConsentUrl } from './plugins.js';
+import { readConsent } from './storage.js';
+import { CONSENT_LINK_VERSION, LANGUAGE_TAG } from './consts.local.js';
+const categoriesOf = (opts) => opts?.categories ?? DEFAULT_CONSENT_CATEGORIES;
+const optionalOf = (opts) => categoriesOf(opts).filter(category => category.required !== true);
+const toBase64Url = (json) => btoa(json).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+const fromBase64Url = (value) => {
+    try {
+        let padded = value.replace(/-/g, '+').replace(/_/g, '/');
+        while (padded.length % 4 !== 0) {
+            padded += '=';
+        }
+        return atob(padded);
+    }
+    catch {
+        return null;
+    }
+};
+/** The language this document is written in — `<html lang>`, the one signal every page has. */
+const documentLanguage = () => {
+    if (typeof document === 'undefined') {
+        return null;
+    }
+    const lang = document.documentElement?.lang?.trim() ?? '';
+    return LANGUAGE_TAG.test(lang) ? lang.toLowerCase() : null;
+};
+/**
+ * The link parameter's value: the current document's decision as `c` (one `0`/`1` per optional
+ * category — empty while `record` is `null`, i.e. before the visitor has decided) and, when
+ * `opts.linker.language` is set, the page's language as `l`.
+ */
+export const encodeConsentLink = (record, opts) => {
+    const c = {};
+    if (record != null) {
+        for (const category of optionalOf(opts)) {
+            c[category.key] = record[category.key] === true ? 1 : 0;
+        }
+    }
+    const language = opts?.linker?.language != null ? documentLanguage() : null;
+    const payload = {
+        v: CONSENT_LINK_VERSION, c, t: Math.floor(Date.now() / 1000), ...(language != null ? { l: language } : {}),
+    };
+    return toBase64Url(JSON.stringify(payload));
+};
+/** Parse-only — no trust decision here, that is `consentLinker(opts).adopt`'s job. Never throws. */
+export const decodeConsentLink = (value) => {
+    const json = fromBase64Url(value);
+    if (json == null) {
+        return null;
+    }
+    try {
+        const parsed = JSON.parse(json);
+        if (parsed == null || typeof parsed !== 'object') {
+            return null;
+        }
+        const { v, c, t, l } = parsed;
+        if (v !== CONSENT_LINK_VERSION || typeof t !== 'number' || c == null || typeof c !== 'object') {
+            return null;
+        }
+        return {
+            v: CONSENT_LINK_VERSION, c: c, t,
+            // A malformed language is dropped, never a reason to refuse the decision beside it.
+            ...(typeof l === 'string' && LANGUAGE_TAG.test(l) ? { l: l.toLowerCase() } : {}),
+        };
+    }
+    catch {
+        return null;
+    }
+};
+const referrerHostname = () => {
+    if (typeof document === 'undefined' || document.referrer === '') {
+        return null;
+    }
+    try {
+        return new URL(document.referrer).hostname;
+    }
+    catch {
+        return null;
+    }
+};
+/**
+ * The payload of the link this document was opened from, once it has passed every check that does
+ * not depend on WHAT it carries: the parameter decodes and its version matches, its timestamp is
+ * fresh (and not from the future beyond the allowed skew), and the request's referrer host is a
+ * LISTED domain — read from `document.referrer`, never from the parameter itself. `null` otherwise.
+ */
+const trustedPayload = (opts) => {
+    const linker = opts.linker;
+    if (linker == null || typeof location === 'undefined') {
+        return null;
+    }
+    const raw = new URLSearchParams(location.search).get(linker.param ?? CONSENT_LINK_PARAM);
+    if (raw == null) {
+        return null;
+    }
+    const decoded = decodeConsentLink(raw);
+    if (decoded == null) {
+        return null;
+    }
+    const now = Math.floor(Date.now() / 1000);
+    const maxAge = linker.maxAge ?? CONSENT_LINK_MAX_AGE;
+    if (now - decoded.t > maxAge || decoded.t - now > CONSENT_LINK_SKEW) {
+        return null;
+    }
+    const referrer = referrerHostname();
+    if (referrer == null || !linker.domains.includes(referrer)) {
+        return null;
+    }
+    return decoded;
+};
+/** The entry of `supported` that `language` names — exactly, else by its base tag — or `null`. */
+const supportedLanguage = (language, supported) => {
+    const wanted = language.toLowerCase();
+    const exact = supported.find(candidate => candidate.toLowerCase() === wanted);
+    if (exact != null) {
+        return exact;
+    }
+    const base = wanted.split(/[-_]/)[0];
+    return supported.find(candidate => candidate.toLowerCase() === base) ?? null;
+};
+/**
+ * Persist an adopted language where the application's i18n layer reads its explicit choice from —
+ * `linker.language.storageKey`, `owlmeans-lng` by default. Unconditional: the interface language is
+ * strictly necessary storage (the visitor picked it, and the site cannot speak to them without it),
+ * so no cookie decision — none yet, a refusal, an old record — stands between it and the device.
+ *
+ * It overwrites what is there on purpose: the carried language is the one the visitor was reading a
+ * moment ago, which outranks a choice they made on this domain some other day. Storage that refuses
+ * the write is not an error. Returns whether the language was written.
+ */
+export const writeConsentLanguage = (language, opts) => {
+    try {
+        localStorage.setItem(opts?.linker?.language?.storageKey ?? CONSENT_LANGUAGE_KEY, language);
+        return true;
+    }
+    catch {
+        // Private modes and blocked storage both throw; the app simply keeps choosing its own language.
+        return false;
+    }
+};
+/** Escape `<` inside a JSON literal meant for an inline `<script>` — the same discipline every
+ * caller of `consentBootstrapScript`/`consentGateScript` already owes the HTML it lands in, applied
+ * here at the source since this fragment's dynamic values (a configured domain, a storage key) are
+ * least likely to have been reviewed for it by whoever composes the final page. */
+const jsonForScript = (value) => JSON.stringify(value).replace(/</g, '\\u003c');
+/**
+ * Cross-domain consent: share this decision, and adopt one, between the domains named in
+ * `opts.linker.domains`.
+ *
+ * `start` decorates outgoing first-party links; `adopt` reads and validates an incoming one;
+ * `domains` discloses the list a dialog or policy page names. `decorate` is generic (a bare `URL`,
+ * no DOM) so the same trust rule serves a real anchor click and a programmatic navigation
+ * (`decorateConsentUrl`) alike — the `rel="noreferrer"` exemption is a DOM-only concept and is
+ * therefore checked by `start`'s click handler, never here.
+ */
+export const consentLinker = () => {
+    let installed = false;
+    return {
+        alias: 'linker',
+        start: opts => {
+            if (typeof document === 'undefined' || installed || opts.linker == null) {
+                return;
+            }
+            installed = true;
+            const onNavigate = (event) => {
+                const target = event.target;
+                const anchor = target instanceof Element ? target.closest('a[href]') : null;
+                if (!(anchor instanceof HTMLAnchorElement)) {
+                    return;
+                }
+                // The trust rule keeps `noreferrer` links untouched: a link that refuses to disclose the
+                // referrer is refusing exactly the signal the receiving side's `adopt` needs to trust it.
+                if (/\bnoreferrer\b/.test(anchor.getAttribute('rel') ?? '')) {
+                    return;
+                }
+                // No decision yet is still worth a decoration when a language rides along with it.
+                const record = readConsent(opts);
+                if (record == null && opts.linker?.language == null) {
+                    return;
+                }
+                let url;
+                try {
+                    url = new URL(anchor.href, location.href);
+                }
+                catch {
+                    return;
+                }
+                const decorated = decorateConsentUrl(url, record, opts);
+                if (decorated.toString() !== url.toString()) {
+                    anchor.href = decorated.toString();
+                }
+            };
+            // Capture phase: this must decide before the click's own navigation (or a framework router
+            // intercepting it) reads `href`. `auxclick`/`contextmenu` cover a middle-click and "copy link
+            // address" — an address copied undecorated is a link that silently fails to carry the choice.
+            document.addEventListener('click', onNavigate, true);
+            document.addEventListener('auxclick', onNavigate, true);
+            document.addEventListener('contextmenu', onNavigate, true);
+        },
+        decorate: (url, record, opts) => {
+            const linker = opts.linker;
+            const host = typeof location !== 'undefined' ? location.hostname : '';
+            if (linker == null || url.hostname === host || !linker.domains.includes(url.hostname)) {
+                return null;
+            }
+            // A link carries a decision, a language, or both; with neither there is nothing to say.
+            if (record == null && (linker.language == null || documentLanguage() == null)) {
+                return null;
+            }
+            const next = new URL(url.toString());
+            next.searchParams.set(linker.param ?? CONSENT_LINK_PARAM, encodeConsentLink(record, opts));
+            return next;
+        },
+        adopt: opts => {
+            const decoded = trustedPayload(opts);
+            if (decoded == null) {
+                return null;
+            }
+            const optional = optionalOf(opts);
+            if (!optional.every(category => decoded.c[category.key] === 0 || decoded.c[category.key] === 1)) {
+                return null;
+            }
+            const record = { v: CONSENT_SCHEMA_VERSION };
+            for (const category of categoriesOf(opts)) {
+                record[category.key] = category.required === true || decoded.c[category.key] === 1;
+            }
+            return record;
+        },
+        adoptLanguage: opts => {
+            const supported = opts.linker?.language?.supported;
+            const decoded = supported != null ? trustedPayload(opts) : null;
+            return decoded?.l != null && supported != null ? supportedLanguage(decoded.l, supported) : null;
+        },
+        domains: opts => opts.linker?.domains ?? [],
+    };
+};
+/**
+ * Remove the link parameter from the visible URL, keeping every other parameter and the hash — the
+ * real-TS equivalent of what {@link consentLinkerScript}'s embedded fragment already did inline.
+ * Idempotent: a page with no head script calls this from `consentStore.init` and it strips once; a
+ * page that ALSO carried the head script finds the parameter already gone and does nothing.
+ */
+export const stripConsentLinkParam = (opts) => {
+    const linker = opts.linker;
+    if (linker == null || typeof location === 'undefined' || typeof history === 'undefined') {
+        return;
+    }
+    const param = linker.param ?? CONSENT_LINK_PARAM;
+    const url = new URL(location.href);
+    if (!url.searchParams.has(param)) {
+        return;
+    }
+    url.searchParams.delete(param);
+    try {
+        history.replaceState(history.state, '', `${url.pathname}${url.search}${url.hash}`);
+    }
+    catch {
+        // A sandboxed/embedded context may refuse history writes; the parameter just stays visible.
+    }
+};
+/**
+ * The inline `<head>` fragment that adopts a decorated link's decision and strips the parameter —
+ * standalone, so a page can stamp it even where nothing else here runs (a legal page with no tag
+ * script). `@owlmeans/web-gtm`'s `consentBootstrapScript` embeds this SAME fragment right after
+ * pushing Consent Mode's defaults, so a page that has both never runs it twice with different
+ * effect — the second attempt finds the parameter already gone and does nothing.
+ *
+ * Mirrors `consentLinker().adopt` exactly (v2, referrer + freshness/skew + full optional coverage +
+ * no existing record), but as hand-rolled JS text rather than a call into this module — the same
+ * discipline `consentBootstrapScript`/`consentGateScript` already follow, because this has to run
+ * before any bundle (this module included) has loaded. The parameter is ALWAYS stripped via
+ * `history.replaceState`, whether or not the trust rule accepts it: a stale or foreign `owlcc` is
+ * exactly as much noise as an adopted one, and neither belongs in the visible URL or in what a page
+ * reload, a shared link or a browser history entry carries forward.
+ */
+export const consentLinkerScript = (opts) => {
+    const linker = opts.linker;
+    if (linker == null) {
+        return '';
+    }
+    const param = jsonForScript(linker.param ?? CONSENT_LINK_PARAM);
+    const domains = jsonForScript(linker.domains);
+    const storageKey = jsonForScript(opts.storageKey ?? CONSENT_KEY);
+    const optionalKeys = jsonForScript(optionalOf(opts).map(category => category.key));
+    const allCategories = jsonForScript(categoriesOf(opts).map(category => ({ key: category.key, required: category.required === true })));
+    const maxAge = linker.maxAge ?? CONSENT_LINK_MAX_AGE;
+    const skew = CONSENT_LINK_SKEW;
+    const cookieDays = opts.cookieDays ?? CONSENT_COOKIE_DAYS;
+    const version = CONSENT_LINK_VERSION;
+    // The language rides the same trust decision and is written unconditionally — it is strictly
+    // necessary storage, whatever the cookie decision is. Mirrors `supportedLanguage` +
+    // `writeConsentLanguage`; empty for a page that does not receive a language.
+    const language = linker.language?.supported != null
+        ? `var L=${jsonForScript(linker.language.supported)};` +
+            `if(typeof j.l==='string'){var lc=j.l.toLowerCase(),lm=null,q;` +
+            `for(q=0;q<L.length;q++){if(String(L[q]).toLowerCase()===lc){lm=L[q];break}}` +
+            `if(!lm){lc=lc.split(/[-_]/)[0];for(q=0;q<L.length;q++){if(String(L[q]).toLowerCase()===lc){lm=L[q];break}}}` +
+            `if(lm){try{w.localStorage.setItem(${jsonForScript(linker.language.storageKey ?? CONSENT_LANGUAGE_KEY)},lm)}catch(e){}}}`
+        : '';
+    return `(function(w,d){` +
+        `var p=${param};var qs;try{qs=new URLSearchParams(location.search)}catch(e){return}` +
+        `var raw=qs.get(p);if(raw==null)return;` +
+        `qs.delete(p);var rest=qs.toString();` +
+        `var url=location.pathname+(rest?('?'+rest):'')+location.hash;` +
+        `try{history.replaceState(history.state,'',url)}catch(e){}` +
+        `try{` +
+        `var b=raw.replace(/-/g,'+').replace(/_/g,'/');while(b.length%4)b+='=';` +
+        `var j=JSON.parse(atob(b));` +
+        `if(!j||j.v!==${version}||typeof j.t!=='number'||!j.c||typeof j.c!=='object')return;` +
+        `var now=Math.floor(Date.now()/1000);` +
+        `if(now-j.t>${maxAge}||j.t-now>${skew})return;` +
+        `var ref=null;try{ref=new URL(d.referrer).hostname}catch(e){}` +
+        `if(!ref||${domains}.indexOf(ref)<0)return;` +
+        `var existing=null;try{existing=w.localStorage.getItem(${storageKey})}catch(e){}` +
+        `if(!existing){var cp=('; '+d.cookie).split('; '+${storageKey}+'=');` +
+        `if(cp.length===2)existing=cp.pop().split(';').shift()}` +
+        `if(!existing){` +
+        `var keys=${optionalKeys},ok=true;` +
+        `for(var i=0;i<keys.length;i++){if(j.c[keys[i]]!==0&&j.c[keys[i]]!==1){ok=false;break}}` +
+        `if(ok){` +
+        `var cats=${allCategories},rec={v:${version}};` +
+        `for(var k=0;k<cats.length;k++){var c=cats[k];rec[c.key]=c.required||j.c[c.key]===1}` +
+        `var val=JSON.stringify(rec);` +
+        `try{w.localStorage.setItem(${storageKey},val)}catch(e){}` +
+        `var exp=new Date(Date.now()+${cookieDays}*86400000).toUTCString();` +
+        `d.cookie=${storageKey}+'='+val+';expires='+exp+';path=/;SameSite=Lax'` +
+        `}` +
+        `}` +
+        language +
+        `}catch(e){}` +
+        `})(window,document)`;
+};
+//# sourceMappingURL=linker.js.map