@owlmeans/consent 0.1.18-rc.2

package/build/storage.js

@@ -0,0 +1,86 @@
+import { CONSENT_COOKIE_DAYS, CONSENT_ESSENTIAL, CONSENT_KEY, CONSENT_SCHEMA_VERSION, } from './consts.js';
+const key = (opts) => opts?.storageKey ?? CONSENT_KEY;
+const parse = (raw) => {
+    if (raw == null || raw === '') {
+        return null;
+    }
+    try {
+        const value = JSON.parse(raw);
+        return value != null && typeof value === 'object' ? value : null;
+    }
+    catch {
+        return null;
+    }
+};
+/**
+ * Bring a stored record up to the current shape.
+ *
+ * A record with no `v` was written before the essential category existed, when it was implicitly
+ * always granted. The visitor DID choose; upgrading in place honours that choice, where treating
+ * the record as unusable would re-prompt everyone who has ever visited.
+ */
+export const migrateConsent = (raw) => raw == null ? null
+    : raw.v === CONSENT_SCHEMA_VERSION ? raw
+        : { ...raw, [CONSENT_ESSENTIAL]: true, v: CONSENT_SCHEMA_VERSION };
+const fromCookie = (name) => {
+    if (typeof document === 'undefined') {
+        return null;
+    }
+    const parts = `; ${document.cookie}`.split(`; ${name}=`);
+    return parts.length === 2 ? parts.pop()?.split(';').shift() ?? null : null;
+};
+/**
+ * What this browser has already chosen, or null.
+ *
+ * localStorage first and the cookie second, because that is the order the widget this generalises
+ * used and the two can disagree: a visitor who cleared site data but kept cookies still has an
+ * answer, and asking them again would be wrong.
+ */
+export const readConsent = (opts) => {
+    const name = key(opts);
+    let raw = null;
+    try {
+        raw = typeof localStorage !== 'undefined' ? localStorage.getItem(name) : null;
+    }
+    catch { /* private modes and blocked storage both throw; the cookie may still answer */ }
+    return migrateConsent(parse(raw) ?? parse(fromCookie(name)));
+};
+/**
+ * Record the choice in both places.
+ *
+ * Two stores rather than one because neither is reliable alone: localStorage is cleared by "clear
+ * site data" while the cookie survives it, and the cookie is refused where third-party storage is
+ * blocked while localStorage may not be.
+ */
+export const writeConsent = (record, opts) => {
+    const name = key(opts);
+    const value = JSON.stringify({ ...record, v: CONSENT_SCHEMA_VERSION });
+    try {
+        if (typeof localStorage !== 'undefined') {
+            localStorage.setItem(name, value);
+        }
+    }
+    catch { /* the cookie below is the fallback */ }
+    if (typeof document === 'undefined') {
+        return;
+    }
+    const days = opts?.cookieDays ?? CONSENT_COOKIE_DAYS;
+    const expires = new Date(Date.now() + days * 24 * 60 * 60 * 1000).toUTCString();
+    const domain = opts?.cookieDomain != null ? `;domain=${opts.cookieDomain}` : '';
+    // `SameSite=Lax` is stated rather than left to the browser default, which differs between them.
+    // This cookie is never sent cross-site on purpose — it records a preference, not a session.
+    document.cookie = `${name}=${value};expires=${expires};path=/;SameSite=Lax${domain}`;
+};
+export const clearConsent = (opts) => {
+    const name = key(opts);
+    try {
+        if (typeof localStorage !== 'undefined') {
+            localStorage.removeItem(name);
+        }
+    }
+    catch { /* nothing to remove if storage was never available */ }
+    if (typeof document !== 'undefined') {
+        document.cookie = `${name}=;expires=Thu, 01 Jan 1970 00:00:00 GMT;path=/`;
+    }
+};
+//# sourceMappingURL=storage.js.map

package/build/storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EAAE,iBAAiB,EAAE,WAAW,EAAE,sBAAsB,GAC5E,MAAM,aAAa,CAAA;AAGpB,MAAM,GAAG,GAAG,CAAC,IAAqB,EAAU,EAAE,CAAC,IAAI,EAAE,UAAU,IAAI,WAAW,CAAA;AAE9E,MAAM,KAAK,GAAG,CAAC,GAA8B,EAAwB,EAAE;IACrE,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAA;QAExC,OAAO,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAsB,CAAC,CAAC,CAAC,IAAI,CAAA;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAyB,EAAwB,EAAE,CAChF,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI;IAChB,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,sBAAsB,CAAC,CAAC,CAAC,GAAG;QACtC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,sBAAsB,EAAE,CAAA;AAExE,MAAM,UAAU,GAAG,CAAC,IAAY,EAAiB,EAAE;IACjD,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE,CAAC;QACpC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,GAAG,CAAC,CAAA;IAExD,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;AAC5E,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAqB,EAAwB,EAAE;IACzE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAA;IACtB,IAAI,GAAG,GAAkB,IAAI,CAAA;IAC7B,IAAI,CAAC;QACH,GAAG,GAAG,OAAO,YAAY,KAAK,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC/E,CAAC;IAAC,MAAM,CAAC,CAAC,+EAA+E,CAAC,CAAC;IAE3F,OAAO,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AAC9D,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAqB,EAAE,IAAqB,EAAQ,EAAE;IACjF,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAA;IACtB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,EAAE,sBAAsB,EAAE,CAAC,CAAA;IACtE,IAAI,CAAC;QACH,IAAI,OAAO,YAAY,KAAK,WAAW,EAAE,CAAC;YACxC,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACnC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,sCAAsC,CAAC,CAAC;IAElD,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE,CAAC;QACpC,OAAM;IACR,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,EAAE,UAAU,IAAI,mBAAmB,CAAA;IACpD,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAA;IAC/E,MAAM,MAAM,GAAG,IAAI,EAAE,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC/E,gGAAgG;IAChG,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,KAAK,YAAY,OAAO,uBAAuB,MAAM,EAAE,CAAA;AACtF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAqB,EAAQ,EAAE;IAC1D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAA;IACtB,IAAI,CAAC;QACH,IAAI,OAAO,YAAY,KAAK,WAAW,EAAE,CAAC;YACxC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,sDAAsD,CAAC,CAAC;IAClE,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE,CAAC;QACpC,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,gDAAgD,CAAA;IAC3E,CAAC;AACH,CAAC,CAAA"}

package/build/store.d.ts

@@ -0,0 +1,16 @@
+import type { ConsentReason, ConsentStore } from './types.js';
+/**
+ * The consent state of this DOCUMENT.
+ *
+ * A module singleton rather than something hung off a context, because that is what consent
+ * actually is — a property of the browser and the page, not of one component tree. It also has to
+ * be reachable from places that are not React at all: the sign-in precondition runs inside a click
+ * handler, and a tag-manager helper runs before any component has mounted.
+ */
+export declare const makeConsentStore: () => ConsentStore;
+export declare const consentStore: ConsentStore;
+/** Open the preferences dialog from anywhere — a footer link, a policy page, a login gate. */
+export declare const openConsent: (reason?: ConsentReason) => void;
+/** Whether a category is granted, for the callers that are not components. */
+export declare const isConsented: (key: string) => boolean;
+//# sourceMappingURL=store.d.ts.map

package/build/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACuB,aAAa,EAA+B,YAAY,EAC1F,MAAM,YAAY,CAAA;AAEnB;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,QAAO,YAsEnC,CAAA;AAED,eAAO,MAAM,YAAY,EAAE,YAAiC,CAAA;AAE5D,8FAA8F;AAC9F,eAAO,MAAM,WAAW,YAAa,aAAa,KAAG,IAAiC,CAAA;AAEtF,8EAA8E;AAC9E,eAAO,MAAM,WAAW,QAAS,MAAM,KAAG,OAAoC,CAAA"}

package/build/store.js

@@ -0,0 +1,70 @@
+import { CONSENT_KEY, DEFAULT_CONSENT_CATEGORIES } from './consts.js';
+import { applyConsent, pushConsentDefaults } from './gtm.js';
+import { readConsent, writeConsent } from './storage.js';
+/**
+ * The consent state of this DOCUMENT.
+ *
+ * A module singleton rather than something hung off a context, because that is what consent
+ * actually is — a property of the browser and the page, not of one component tree. It also has to
+ * be reachable from places that are not React at all: the sign-in precondition runs inside a click
+ * handler, and a tag-manager helper runs before any component has mounted.
+ */
+export const makeConsentStore = () => {
+    const listeners = new Set();
+    let state = { record: null, open: false, reason: null };
+    let options = {};
+    const publish = (next) => {
+        state = { ...state, ...next };
+        listeners.forEach(listener => listener(state));
+    };
+    const resolved = () => ({
+        ...options,
+        categories: options.categories ?? DEFAULT_CONSENT_CATEGORIES,
+        storageKey: options.storageKey ?? CONSENT_KEY,
+    });
+    const store = {
+        get: () => state,
+        subscribe: listener => {
+            listeners.add(listener);
+            return () => { listeners.delete(listener); };
+        },
+        init: opts => {
+            options = { ...options, ...opts };
+            // Before anything is read, so a page with no stored answer still declares what is denied.
+            pushConsentDefaults(options);
+            const record = readConsent(options);
+            if (record != null) {
+                applyConsent(record, options);
+                publish({ record, open: false, reason: null });
+                return;
+            }
+            publish({ record: null, open: true, reason: 'initial' });
+        },
+        save: record => {
+            writeConsent(record, options);
+            applyConsent(record, options);
+            publish({ record, open: false, reason: null });
+        },
+        acceptAll: () => {
+            const record = Object.fromEntries(resolved().categories.map(category => [category.key, true]));
+            store.save(record);
+        },
+        open: (reason) => { publish({ open: true, reason: reason ?? 'reopen' }); },
+        close: () => { publish({ open: false, reason: null }); },
+        granted: key => {
+            const category = resolved().categories.find(candidate => candidate.key === key);
+            if (category?.required === true) {
+                return true;
+            }
+            return state.record?.[key] === true;
+        },
+        options: resolved,
+    };
+    return store;
+};
+export const consentStore = makeConsentStore();
+/** Open the preferences dialog from anywhere — a footer link, a policy page, a login gate. */
+export const openConsent = (reason) => consentStore.open(reason);
+/** Whether a category is granted, for the callers that are not components. */
+export const isConsented = (key) => consentStore.granted(key);
+//# sourceMappingURL=store.js.map

package/build/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAA;AACrE,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AAC5D,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAKxD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAiB,EAAE;IACjD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAmB,CAAA;IAC5C,IAAI,KAAK,GAAiB,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IACrE,IAAI,OAAO,GAAmB,EAAE,CAAA;IAEhC,MAAM,OAAO,GAAG,CAAC,IAA2B,EAAQ,EAAE;QACpD,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,IAAI,EAAE,CAAA;QAC7B,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;IAChD,CAAC,CAAA;IAED,MAAM,QAAQ,GAAG,GAA2F,EAAE,CAAC,CAAC;QAC9G,GAAG,OAAO;QACV,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,0BAA0B;QAC5D,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,WAAW;KAC9C,CAAC,CAAA;IAEF,MAAM,KAAK,GAAiB;QAC1B,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK;QAEhB,SAAS,EAAE,QAAQ,CAAC,EAAE;YACpB,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YAEvB,OAAO,GAAG,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA,CAAC,CAAC,CAAA;QAC7C,CAAC;QAED,IAAI,EAAE,IAAI,CAAC,EAAE;YACX,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,IAAI,EAAE,CAAA;YACjC,0FAA0F;YAC1F,mBAAmB,CAAC,OAAO,CAAC,CAAA;YAE5B,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;YACnC,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;gBAC7B,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;gBAE9C,OAAM;YACR,CAAC;YACD,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;QAC1D,CAAC;QAED,IAAI,EAAE,MAAM,CAAC,EAAE;YACb,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;YAC7B,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;YAC7B,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;QAChD,CAAC;QAED,SAAS,EAAE,GAAG,EAAE;YACd,MAAM,MAAM,GAAkB,MAAM,CAAC,WAAW,CAC9C,QAAQ,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAC5D,CAAA;YACD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACpB,CAAC;QAED,IAAI,EAAE,CAAC,MAAsB,EAAE,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAA,CAAC,CAAC;QAEzF,KAAK,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA,CAAC,CAAC;QAEvD,OAAO,EAAE,GAAG,CAAC,EAAE;YACb,MAAM,QAAQ,GAAG,QAAQ,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;YAC/E,IAAI,QAAQ,EAAE,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAChC,OAAO,IAAI,CAAA;YACb,CAAC;YAED,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,CAAA;QACrC,CAAC;QAED,OAAO,EAAE,QAAQ;KAClB,CAAA;IAED,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,YAAY,GAAiB,gBAAgB,EAAE,CAAA;AAE5D,8FAA8F;AAC9F,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAsB,EAAQ,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AAEtF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA"}

package/build/types.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Google Consent Mode v2 signals.
+ *
+ * Named here rather than left as free strings because a typo in a signal name is silent: the tag
+ * manager simply never sees the update, and the only symptom is analytics that stay switched off
+ * for everyone who agreed to them.
+ */
+export type ConsentSignal = 'ad_storage' | 'ad_user_data' | 'ad_personalization' | 'analytics_storage' | 'functionality_storage' | 'personalization_storage' | 'security_storage';
+export interface ConsentCategory {
+    /** Stable storage key. `essential` is reserved and always required. */
+    key: string;
+    /**
+     * Always granted, rendered locked and labelled as required.
+     *
+     * Strictly-necessary storage does not need consent, and a dialog that presents it as a choice is
+     * itself a dark pattern. A required category is disclosure, not a question.
+     */
+    required?: boolean;
+    /** Resolved through `translate`; the built-in bundle supplies the default set in 7 languages. */
+    labelKey: string;
+    descriptionKey: string;
+    /**
+     * The window global this category yields to: `window[globalVar] = granted`, written on every
+     * apply and BEFORE the tag-manager push.
+     *
+     * This is the seam for anything that cannot subscribe — a custom-HTML tag reading a flag, a
+     * hand-placed pixel, a script that only ever runs once. Without it, integrating a tag that is
+     * not Consent-Mode-aware means reaching into this package.
+     */
+    globalVar?: string;
+    /** Consent Mode v2 signals this category drives. */
+    signals?: ConsentSignal[];
+    /** dataLayer event pushed when this category transitions from denied to granted. */
+    event?: string;
+}
+/** `v` is the schema version; every other key is a category key. */
+export interface ConsentRecord {
+    v?: number;
+    [category: string]: boolean | number | undefined;
+}
+export interface ConsentOptions {
+    categories?: ConsentCategory[];
+    storageKey?: string;
+    cookieDays?: number;
+    /**
+     * Left undefined by default, and that is deliberate: setting a domain orphans the existing
+     * host-only cookie, so every visitor who has already chosen would be asked again.
+     */
+    cookieDomain?: string;
+    /** Skip every dataLayer and global write. For tests, and for an app that runs no tags. */
+    silent?: boolean;
+}
+/** Why the dialog is open. `login` is what the sign-in precondition raises. */
+export type ConsentReason = 'initial' | 'reopen' | 'login' | string;
+export interface ConsentState {
+    record: ConsentRecord | null;
+    open: boolean;
+    reason: ConsentReason | null;
+}
+export type ConsentListener = (state: ConsentState) => void;
+export interface ConsentStore {
+    get: () => ConsentState;
+    subscribe: (listener: ConsentListener) => () => void;
+    /** Push the defaults, load and migrate any stored record, apply it, and open when there is none. */
+    init: (opts?: ConsentOptions) => void;
+    save: (record: ConsentRecord) => void;
+    acceptAll: () => void;
+    open: (reason?: ConsentReason) => void;
+    close: () => void;
+    /** Imperative reader, for the callers that are not React. */
+    granted: (key: string) => boolean;
+    options: () => ConsentOptions & {
+        categories: ConsentCategory[];
+        storageKey: string;
+    };
+}
+//# sourceMappingURL=types.d.ts.map

package/build/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GACrB,YAAY,GAAG,cAAc,GAAG,oBAAoB,GACpD,mBAAmB,GAAG,uBAAuB,GAC7C,yBAAyB,GAAG,kBAAkB,CAAA;AAElD,MAAM,WAAW,eAAe;IAC9B,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAA;IACX;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,iGAAiG;IACjG,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;IACtB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,oDAAoD;IACpD,OAAO,CAAC,EAAE,aAAa,EAAE,CAAA;IACzB,oFAAoF;IACpF,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,oEAAoE;AACpE,MAAM,WAAW,aAAa;IAC5B,CAAC,CAAC,EAAE,MAAM,CAAA;IACV,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAAA;CACjD;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,EAAE,eAAe,EAAE,CAAA;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,0FAA0F;IAC1F,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAED,+EAA+E;AAC/E,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAA;AAEnE,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,aAAa,GAAG,IAAI,CAAA;IAC5B,IAAI,EAAE,OAAO,CAAA;IACb,MAAM,EAAE,aAAa,GAAG,IAAI,CAAA;CAC7B;AAED,MAAM,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAA;AAE3D,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,YAAY,CAAA;IACvB,SAAS,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,MAAM,IAAI,CAAA;IACpD,oGAAoG;IACpG,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,cAAc,KAAK,IAAI,CAAA;IACrC,IAAI,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAA;IACrC,SAAS,EAAE,MAAM,IAAI,CAAA;IACrB,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,aAAa,KAAK,IAAI,CAAA;IACtC,KAAK,EAAE,MAAM,IAAI,CAAA;IACjB,6DAA6D;IAC7D,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAA;IACjC,OAAO,EAAE,MAAM,cAAc,GAAG;QAAE,UAAU,EAAE,eAAe,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;CACtF"}

package/build/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@owlmeans/consent",
+  "version": "0.1.18-rc.2",
+  "license": "MIT",
+  "type": "module",
+  "scripts": {
+    "build": "tsc -b",
+    "dev": "sleep 2 && nodemon -e ts,json --watch src --exec \"tsc -p ./tsconfig.json\"",
+    "watch": "tsc -b -w --preserveWatchOutput --pretty",
+    "test": "bun test ./tests"
+  },
+  "main": "build/index.js",
+  "module": "build/index.js",
+  "types": "build/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./build/index.js",
+      "require": "./build/index.js",
+      "default": "./build/index.js",
+      "module": "./build/index.js",
+      "types": "./build/index.d.ts"
+    }
+  },
+  "devDependencies": {
+    "@owlmeans/dep-config": "workspace:*",
+    "@types/bun": "^1.4.0",
+    "nodemon": "^3.1.14",
+    "typescript": "^7.0.2"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/consts.ts

@@ -0,0 +1,75 @@
+import type { ConsentCategory } from './types.js'
+
+/**
+ * Where a visitor's choice is stored.
+ *
+ * Unchanged from the widget this package generalises, and it must stay unchanged: owlmeans.com has
+ * visitors who have already chosen, and a new key would ask every one of them again.
+ */
+export const CONSENT_KEY = 'site_cookie_consent'
+
+export const CONSENT_COOKIE_DAYS = 365
+
+/**
+ * The stored record's shape version.
+ *
+ * A record with no version predates the explicit `essential` category, when essential storage was
+ * implicitly always on. Those records are migrated in place rather than discarded — the visitor
+ * made a decision, and re-asking would be a regression they experience as the site forgetting.
+ */
+export const CONSENT_SCHEMA_VERSION = 2
+
+/** Idempotence flag for the Consent Mode defaults. Fixed: a page may carry two bundles. */
+export const CONSENT_SETUP_FLAG = 'cookieConsentSetup'
+
+export const CONSENT_ESSENTIAL = 'essential'
+export const CONSENT_ANALYTICS = 'analytics'
+export const CONSENT_MARKETING = 'marketing'
+
+export const CONSENT_LOCALES = ['en', 'pl', 'ru', 'be', 'uk', 'es', 'de'] as const
+
+export type ConsentLocale = (typeof CONSENT_LOCALES)[number]
+
+/**
+ * The categories every OwlMeans surface starts with.
+ *
+ * Three, matching what owlmeans.com already asks — plus the essential row, which the original
+ * widget left implicit. Making it explicit is what lets a flow require an acknowledgement before
+ * it sets a session cookie, and what tells a visitor what is being stored regardless.
+ */
+export const DEFAULT_CONSENT_CATEGORIES: ConsentCategory[] = [
+  {
+    key: CONSENT_ESSENTIAL, required: true,
+    labelKey: 'essential', descriptionKey: 'essentialDesc',
+    globalVar: 'owlConsentEssential',
+    signals: ['security_storage', 'functionality_storage'],
+  },
+  {
+    key: CONSENT_ANALYTICS,
+    labelKey: 'analytics', descriptionKey: 'analyticsDesc',
+    globalVar: 'owlConsentAnalytics',
+    signals: ['analytics_storage'],
+  },
+  {
+    key: CONSENT_MARKETING,
+    labelKey: 'marketing', descriptionKey: 'marketingDesc',
+    globalVar: 'owlConsentMarketing',
+    signals: ['ad_storage', 'ad_user_data', 'ad_personalization'],
+  },
+]
+
+/**
+ * Every signal Consent Mode v2 knows, and what it defaults to before anyone has chosen.
+ *
+ * `security_storage` is granted by Google's own documented recommendation — it covers things like
+ * fraud prevention, which are strictly necessary. Everything else starts denied.
+ */
+export const CONSENT_SIGNAL_DEFAULTS: Record<string, 'granted' | 'denied'> = {
+  ad_storage: 'denied',
+  ad_user_data: 'denied',
+  ad_personalization: 'denied',
+  analytics_storage: 'denied',
+  functionality_storage: 'denied',
+  personalization_storage: 'denied',
+  security_storage: 'granted',
+}

package/src/gtm.ts

@@ -0,0 +1,141 @@
+import {
+  CONSENT_KEY, CONSENT_SETUP_FLAG, CONSENT_SIGNAL_DEFAULTS, DEFAULT_CONSENT_CATEGORIES,
+} from './consts.js'
+import type { ConsentCategory, ConsentOptions, ConsentRecord } from './types.js'
+
+interface ConsentWindow {
+  dataLayer?: unknown[]
+  [flag: string]: unknown
+}
+
+const global = (): ConsentWindow | null =>
+  typeof window !== 'undefined' ? window as unknown as ConsentWindow : null
+
+/**
+ * Push onto the tag-manager queue in the shape Google's own snippet uses.
+ *
+ * `arguments`, not an array literal. Both work with today's Consent API, but `arguments` is what
+ * `gtag.js` itself emits, and a page that carries both this and Google's snippet should not have
+ * two shapes in one queue.
+ */
+export function gtagConsent(..._args: unknown[]): void {
+  const win = global()
+  if (win == null) {
+    return
+  }
+  win.dataLayer = win.dataLayer ?? []
+  // `arguments`, not `_args`. The rest parameter is only here to type the call sites; what goes on
+  // the queue must be the arguments object itself.
+  // eslint-disable-next-line prefer-rest-params
+  win.dataLayer.push(arguments)
+}
+
+const categoriesOf = (opts?: ConsentOptions): ConsentCategory[] =>
+  opts?.categories ?? DEFAULT_CONSENT_CATEGORIES
+
+/** Every signal the configured categories drive, at its pre-consent value. */
+export const consentDefaults = (
+  categories?: ConsentCategory[]
+): Record<string, 'granted' | 'denied'> => {
+  const used = new Set((categories ?? DEFAULT_CONSENT_CATEGORIES)
+    .flatMap(category => category.signals ?? []))
+
+  return Object.fromEntries(Object.entries(CONSENT_SIGNAL_DEFAULTS)
+    .filter(([signal]) => used.has(signal as never)))
+}
+
+/** Every signal, at the value this record implies. */
+export const consentUpdate = (
+  record: ConsentRecord, categories?: ConsentCategory[]
+): Record<string, 'granted' | 'denied'> => {
+  const update: Record<string, 'granted' | 'denied'> = {}
+  for (const category of categories ?? DEFAULT_CONSENT_CATEGORIES) {
+    const granted = category.required === true || record[category.key] === true
+    for (const signal of category.signals ?? []) {
+      // A signal named by two categories is granted only when every one of them is.
+      update[signal] = granted && update[signal] !== 'denied' ? 'granted' : 'denied'
+    }
+  }
+
+  return update
+}
+
+/**
+ * Declare what is denied, before any tag can act.
+ *
+ * Idempotent through a window flag, because the page may carry this call twice — once inline in
+ * the document head, once from whatever bundle mounts the dialog — and a second `default` after a
+ * tag has loaded is worse than none: it can widen what was already narrowed.
+ */
+export const pushConsentDefaults = (opts?: ConsentOptions): void => {
+  const win = global()
+  if (win == null || opts?.silent === true || win[CONSENT_SETUP_FLAG] === true) {
+    return
+  }
+  gtagConsent('consent', 'default', consentDefaults(categoriesOf(opts)))
+  win[CONSENT_SETUP_FLAG] = true
+}
+
+/**
+ * Apply a decision: globals first, then the signal update, then any per-category events.
+ *
+ * The order is load-bearing. A tag that fires on the update event reads the globals in the same
+ * turn, so writing them afterwards would let the first firing see the previous answer.
+ */
+export const applyConsent = (record: ConsentRecord, opts?: ConsentOptions): void => {
+  const win = global()
+  if (win == null || opts?.silent === true) {
+    return
+  }
+  const categories = categoriesOf(opts)
+
+  for (const category of categories) {
+    if (category.globalVar != null) {
+      win[category.globalVar] = category.required === true || record[category.key] === true
+    }
+  }
+
+  gtagConsent('consent', 'update', consentUpdate(record, categories))
+
+  for (const category of categories) {
+    if (category.event != null && (category.required === true || record[category.key] === true)) {
+      win.dataLayer = win.dataLayer ?? []
+      win.dataLayer.push({ event: category.event })
+    }
+  }
+}
+
+/**
+ * The inline script a document stamps ABOVE its tag-manager snippet.
+ *
+ * It exists because the defaults have to be on the queue before `gtm.js` loads, and a React bundle
+ * cannot be: by the time an island mounts, the container has been running for hundreds of
+ * milliseconds and has already decided what it may do. Emitting it from the HTML is the only
+ * ordering that holds — and it reads the stored record too, so a returning visitor's tags are not
+ * denied for the first paint of every page.
+ */
+export const consentBootstrapScript = (opts?: ConsentOptions): string => {
+  const defaults = JSON.stringify(consentDefaults(categoriesOf(opts)))
+  const categories = JSON.stringify(categoriesOf(opts).map(category => ({
+    key: category.key,
+    required: category.required === true,
+    signals: category.signals ?? [],
+    globalVar: category.globalVar ?? null,
+  })))
+  const storageKey = JSON.stringify(opts?.storageKey ?? CONSENT_KEY)
+  const flag = JSON.stringify(CONSENT_SETUP_FLAG)
+
+  return `(function(w,d){` +
+    `w.dataLayer=w.dataLayer||[];function g(){w.dataLayer.push(arguments)}` +
+    `if(w[${flag}])return;g('consent','default',${defaults});w[${flag}]=true;` +
+    `var raw=null;try{raw=w.localStorage.getItem(${storageKey})}catch(e){}` +
+    `if(!raw){var p=('; '+d.cookie).split('; '+${storageKey}+'=');` +
+    `if(p.length===2){raw=p.pop().split(';').shift()}}` +
+    `if(!raw)return;var r;try{r=JSON.parse(raw)}catch(e){return}` +
+    `var cs=${categories},u={};` +
+    `for(var i=0;i<cs.length;i++){var c=cs[i];var ok=c.required||r[c.key]===true;` +
+    `if(c.globalVar){w[c.globalVar]=ok}` +
+    `for(var j=0;j<c.signals.length;j++){var s=c.signals[j];` +
+    `u[s]=ok&&u[s]!=='denied'?'granted':'denied'}}` +
+    `g('consent','update',u)})(window,document)`
+}

package/src/i18n/be.json

@@ -0,0 +1,25 @@
+{
+  "title": "Налады файлаў cookie",
+  "description": "Мы выкарыстоўваем файлы cookie, каб палепшыць ваш досвед прагляду, паказваць персаналізаваную рэкламу ці змесціва і аналізаваць наш трафік. Націскаючы «Прыняць усе», вы пагаджаецеся на выкарыстанне файлаў cookie.",
+  "essential": "Неабходныя файлы cookie",
+  "essentialDesc": "Патрэбныя для працы сайта — уваход, бяспека і захаванне гэтых налад. Іх нельга адключыць.",
+  "analytics": "Аналітычныя файлы cookie",
+  "analyticsDesc": "Дапамагаюць нам паляпшаць наш вэб-сайт, збіраючы і паведамляючы інфармацыю пра яго выкарыстанне.",
+  "marketing": "Маркетынгавыя файлы cookie",
+  "marketingDesc": "Выкарыстоўваюцца для адсочвання наведвальнікаў на розных вэб-сайтах дзеля паказу актуальнай і цікавай рэкламы.",
+  "required": "Абавязкова",
+  "acceptAll": "Прыняць усе",
+  "acceptAndContinue": "Прыняць і працягнуць",
+  "savePreferences": "Захаваць налады",
+  "policyLink": "Палітыка файлаў cookie",
+  "openPreferences": "Налады файлаў cookie",
+  "close": "Закрыць",
+  "loginReason": "Уваход захоўвае сеансавы файл cookie. Прыміце неабходныя файлы cookie, каб працягнуць.",
+  "manage": "Змяніць налады",
+  "policyTitle": "Палітыка файлаў cookie",
+  "policyIntro": "Гэтая старонка апісвае файлы cookie і падобныя сховішчы, якія выкарыстоўвае гэтая праграма, і як імі кіраваць.",
+  "policyStorage": "Ваш выбар захоўваецца ў гэтым браўзеры пад ключом «{{key}}» — і ў лакальным сховішчы, і ў файле cookie.",
+  "policyRetention": "Запіс захоўваецца {{days}} дзён, пасля чаго мы спытаем зноў.",
+  "policyOperator": "Гэтая праграма належыць {{operator}}.",
+  "policyContact": "Азнаёмцеся з іх палітыкай прыватнасці і ўмовамі карыстання, каб даведацца, як яны апрацоўваюць вашы даныя."
+}

package/src/i18n/de.json

@@ -0,0 +1,25 @@
+{
+  "title": "Cookie-Einstellungen",
+  "description": "Wir verwenden Cookies, um Ihr Surferlebnis zu verbessern, personalisierte Anzeigen oder Inhalte bereitzustellen und unseren Datenverkehr zu analysieren. Indem Sie auf „Alle akzeptieren\" klicken, stimmen Sie der Verwendung von Cookies zu.",
+  "essential": "Notwendige Cookies",
+  "essentialDesc": "Erforderlich, damit die Website funktioniert — Anmeldung, Sicherheit und das Speichern dieser Einstellungen. Sie lassen sich nicht abschalten.",
+  "analytics": "Analyse-Cookies",
+  "analyticsDesc": "Helfen uns, unsere Website zu verbessern, indem sie Informationen zur Nutzung sammeln und melden.",
+  "marketing": "Marketing-Cookies",
+  "marketingDesc": "Werden verwendet, um Besucher über Websites hinweg zu verfolgen und relevante, ansprechende Werbung anzuzeigen.",
+  "required": "Erforderlich",
+  "acceptAll": "Alle akzeptieren",
+  "acceptAndContinue": "Akzeptieren und fortfahren",
+  "savePreferences": "Einstellungen speichern",
+  "policyLink": "Cookie-Richtlinie",
+  "openPreferences": "Cookie-Einstellungen",
+  "close": "Schließen",
+  "loginReason": "Bei der Anmeldung wird ein Sitzungs-Cookie gespeichert. Akzeptieren Sie die notwendigen Cookies, um fortzufahren.",
+  "manage": "Einstellungen verwalten",
+  "policyTitle": "Cookie-Richtlinie",
+  "policyIntro": "Diese Seite beschreibt die Cookies und ähnliche Speicher, die diese Anwendung verwendet, und wie Sie sie steuern können.",
+  "policyStorage": "Ihre Auswahl wird in diesem Browser unter „{{key}}\" gespeichert — sowohl im lokalen Speicher als auch als Cookie.",
+  "policyRetention": "Der Eintrag wird {{days}} Tage aufbewahrt, danach werden Sie erneut gefragt.",
+  "policyOperator": "Diese Anwendung wird von {{operator}} betrieben.",
+  "policyContact": "Sehen Sie in deren Datenschutzerklärung und Bedingungen nach, wie Ihre Daten verarbeitet werden."
+}

package/src/i18n/en.json

@@ -0,0 +1,25 @@
+{
+  "title": "Cookie Preferences",
+  "description": "We use cookies to enhance your browsing experience, serve personalized ads or content, and analyze our traffic. By clicking \"Accept All\", you consent to our use of cookies.",
+  "essential": "Essential Cookies",
+  "essentialDesc": "Required for the site to work — signing in, security and remembering these preferences. They cannot be switched off.",
+  "analytics": "Analytics Cookies",
+  "analyticsDesc": "Help us improve our website by collecting and reporting information on its usage.",
+  "marketing": "Marketing Cookies",
+  "marketingDesc": "Used to track visitors across websites to display relevant and engaging advertisements.",
+  "required": "Required",
+  "acceptAll": "Accept All",
+  "acceptAndContinue": "Accept & continue",
+  "savePreferences": "Save Preferences",
+  "policyLink": "Cookie Policy",
+  "openPreferences": "Cookie preferences",
+  "close": "Close",
+  "loginReason": "Signing in stores a session cookie. Accept essential cookies to continue.",
+  "manage": "Manage preferences",
+  "policyTitle": "Cookie Policy",
+  "policyIntro": "This page describes the cookies and similar storage this application uses, and how you can control them.",
+  "policyStorage": "Your choice is stored in this browser under \"{{key}}\", both in local storage and as a cookie.",
+  "policyRetention": "The record is kept for {{days}} days, after which you will be asked again.",
+  "policyOperator": "This application is operated by {{operator}}.",
+  "policyContact": "See their privacy policy and terms for how they handle your data."
+}

package/src/i18n/es.json

@@ -0,0 +1,25 @@
+{
+  "title": "Preferencias de cookies",
+  "description": "Utilizamos cookies para mejorar tu experiencia de navegación, ofrecer anuncios o contenido personalizados y analizar nuestro tráfico. Al hacer clic en «Aceptar todo», aceptas nuestro uso de cookies.",
+  "essential": "Cookies esenciales",
+  "essentialDesc": "Necesarias para que el sitio funcione: inicio de sesión, seguridad y recordar estas preferencias. No se pueden desactivar.",
+  "analytics": "Cookies analíticas",
+  "analyticsDesc": "Nos ayudan a mejorar nuestro sitio web recopilando e informando sobre su uso.",
+  "marketing": "Cookies de marketing",
+  "marketingDesc": "Se utilizan para rastrear a los visitantes en distintos sitios web y mostrar anuncios relevantes y atractivos.",
+  "required": "Obligatorias",
+  "acceptAll": "Aceptar todo",
+  "acceptAndContinue": "Aceptar y continuar",
+  "savePreferences": "Guardar preferencias",
+  "policyLink": "Política de cookies",
+  "openPreferences": "Preferencias de cookies",
+  "close": "Cerrar",
+  "loginReason": "Iniciar sesión guarda una cookie de sesión. Acepta las cookies esenciales para continuar.",
+  "manage": "Gestionar preferencias",
+  "policyTitle": "Política de cookies",
+  "policyIntro": "Esta página describe las cookies y el almacenamiento similar que utiliza esta aplicación, y cómo puedes controlarlos.",
+  "policyStorage": "Tu elección se guarda en este navegador bajo «{{key}}», tanto en el almacenamiento local como en una cookie.",
+  "policyRetention": "El registro se conserva {{days}} días, tras los cuales se te preguntará de nuevo.",
+  "policyOperator": "Esta aplicación está gestionada por {{operator}}.",
+  "policyContact": "Consulta su política de privacidad y sus términos para saber cómo tratan tus datos."
+}