@owlmeans/consent 0.1.18-rc.5 → 0.1.18-rc.6

package/build/consts.d.ts

@@ -17,6 +17,16 @@ export declare const CONSENT_COOKIE_DAYS = 365;
 export declare const CONSENT_SCHEMA_VERSION = 2;
 /** Idempotence flag for the Consent Mode defaults. Fixed: a page may carry two bundles. */
 export declare const CONSENT_SETUP_FLAG = "cookieConsentSetup";
+/**
+ * The DOM event `applyConsent` dispatches on `window` after it finishes writing globals and
+ * pushing the Consent Mode update.
+ *
+ * A loader that already ran (a gate script that decided, on first paint, not to load yet) has no
+ * other way to hear a LATER grant — Consent Mode itself speaks only on `window.dataLayer`, which a
+ * tag that has not loaded is not listening to. `event.detail.record` carries the record that was
+ * just applied.
+ */
+export declare const CONSENT_EVENT = "owlmeans:consent";
 export declare const CONSENT_ESSENTIAL = "essential";
 export declare const CONSENT_ANALYTICS = "analytics";
 export declare const CONSENT_MARKETING = "marketing";

package/build/consts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAEjD;;;;;GAKG;AACH,eAAO,MAAM,WAAW,wBAAwB,CAAA;AAEhD,eAAO,MAAM,mBAAmB,MAAM,CAAA;AAEtC;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAA;AAEvC,2FAA2F;AAC3F,eAAO,MAAM,kBAAkB,uBAAuB,CAAA;AAEtD,eAAO,MAAM,iBAAiB,cAAc,CAAA;AAC5C,eAAO,MAAM,iBAAiB,cAAc,CAAA;AAC5C,eAAO,MAAM,iBAAiB,cAAc,CAAA;AAE5C,eAAO,MAAM,eAAe,YAAI,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAU,CAAA;AAExF,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAA;AAE5D;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,EAAE,eAAe,EAmBvD,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,CAQxE,CAAA"}
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAEjD;;;;;GAKG;AACH,eAAO,MAAM,WAAW,wBAAwB,CAAA;AAEhD,eAAO,MAAM,mBAAmB,MAAM,CAAA;AAEtC;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAA;AAEvC,2FAA2F;AAC3F,eAAO,MAAM,kBAAkB,uBAAuB,CAAA;AAEtD;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,qBAAqB,CAAA;AAE/C,eAAO,MAAM,iBAAiB,cAAc,CAAA;AAC5C,eAAO,MAAM,iBAAiB,cAAc,CAAA;AAC5C,eAAO,MAAM,iBAAiB,cAAc,CAAA;AAE5C,eAAO,MAAM,eAAe,YAAI,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAU,CAAA;AAExF,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAA;AAE5D;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,EAAE,eAAe,EAmBvD,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,CAQxE,CAAA"}

package/build/consts.js

@@ -16,6 +16,16 @@ export const CONSENT_COOKIE_DAYS = 365;
 export const CONSENT_SCHEMA_VERSION = 2;
 /** Idempotence flag for the Consent Mode defaults. Fixed: a page may carry two bundles. */
 export const CONSENT_SETUP_FLAG = 'cookieConsentSetup';
+/**
+ * The DOM event `applyConsent` dispatches on `window` after it finishes writing globals and
+ * pushing the Consent Mode update.
+ *
+ * A loader that already ran (a gate script that decided, on first paint, not to load yet) has no
+ * other way to hear a LATER grant — Consent Mode itself speaks only on `window.dataLayer`, which a
+ * tag that has not loaded is not listening to. `event.detail.record` carries the record that was
+ * just applied.
+ */
+export const CONSENT_EVENT = 'owlmeans:consent';
 export const CONSENT_ESSENTIAL = 'essential';
 export const CONSENT_ANALYTICS = 'analytics';
 export const CONSENT_MARKETING = 'marketing';

package/build/consts.js.map

@@ -1 +1 @@
-{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,qBAAqB,CAAA;AAEhD,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAA;AAEtC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAA;AAEvC,2FAA2F;AAC3F,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAA;AAEtD,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAA;AAC5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAA;AAC5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAA;AAE5C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAU,CAAA;AAIxF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D;QACE,GAAG,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI;QACtC,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe;QACtD,SAAS,EAAE,qBAAqB;QAChC,OAAO,EAAE,CAAC,kBAAkB,EAAE,uBAAuB,CAAC;KACvD;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe;QACtD,SAAS,EAAE,qBAAqB;QAChC,OAAO,EAAE,CAAC,mBAAmB,CAAC;KAC/B;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe;QACtD,SAAS,EAAE,qBAAqB;QAChC,OAAO,EAAE,CAAC,YAAY,EAAE,cAAc,EAAE,oBAAoB,CAAC;KAC9D;CACF,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAyC;IAC3E,UAAU,EAAE,QAAQ;IACpB,YAAY,EAAE,QAAQ;IACtB,kBAAkB,EAAE,QAAQ;IAC5B,iBAAiB,EAAE,QAAQ;IAC3B,qBAAqB,EAAE,QAAQ;IAC/B,uBAAuB,EAAE,QAAQ;IACjC,gBAAgB,EAAE,SAAS;CAC5B,CAAA"}
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,qBAAqB,CAAA;AAEhD,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAA;AAEtC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAA;AAEvC,2FAA2F;AAC3F,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAA;AAEtD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,kBAAkB,CAAA;AAE/C,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAA;AAC5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAA;AAC5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAA;AAE5C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAU,CAAA;AAIxF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D;QACE,GAAG,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI;QACtC,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe;QACtD,SAAS,EAAE,qBAAqB;QAChC,OAAO,EAAE,CAAC,kBAAkB,EAAE,uBAAuB,CAAC;KACvD;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe;QACtD,SAAS,EAAE,qBAAqB;QAChC,OAAO,EAAE,CAAC,mBAAmB,CAAC;KAC/B;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe;QACtD,SAAS,EAAE,qBAAqB;QAChC,OAAO,EAAE,CAAC,YAAY,EAAE,cAAc,EAAE,oBAAoB,CAAC;KAC9D;CACF,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAyC;IAC3E,UAAU,EAAE,QAAQ;IACpB,YAAY,EAAE,QAAQ;IACtB,kBAAkB,EAAE,QAAQ;IAC5B,iBAAiB,EAAE,QAAQ;IAC3B,qBAAqB,EAAE,QAAQ;IAC/B,uBAAuB,EAAE,QAAQ;IACjC,gBAAgB,EAAE,SAAS;CAC5B,CAAA"}

package/build/gtm.d.ts

@@ -26,6 +26,16 @@ export declare const pushConsentDefaults: (opts?: ConsentOptions) => void;
  * turn, so writing them afterwards would let the first firing see the previous answer.
  */
 export declare const applyConsent: (record: ConsentRecord, opts?: ConsentOptions) => void;
+/**
+ * Whether a stored decision grants tracking at all — a signal-bearing category, not merely the
+ * required essential one.
+ *
+ * "Signal-bearing" is what a required category can never be: it exists to gate whether a LOADER
+ * runs, and a required category is disclosure, not a question — everyone gets it. Only a category
+ * that both is optional and drives at least one Consent Mode signal counts, which is exactly what
+ * `googleTagHeadScript`'s `'basic'` mode gates a Google tag behind.
+ */
+export declare const trackingGranted: (record: ConsentRecord | null, categories?: ConsentCategory[]) => boolean;
 /**
  * The inline script a document stamps ABOVE its tag-manager snippet.
  *
@@ -36,4 +46,27 @@ export declare const applyConsent: (record: ConsentRecord, opts?: ConsentOptions
  * denied for the first paint of every page.
  */
 export declare const consentBootstrapScript: (opts?: ConsentOptions) => string;
+/**
+ * Withhold a loader until a stored or later decision grants tracking.
+ *
+ * The counterpart to `consentBootstrapScript` for the `'basic'` gated loading mode
+ * (`@owlmeans/web-gtm`'s `GOOGLE_TAG_DEFAULT_MODE`): where the bootstrap always declares Consent
+ * Mode's defaults so a tag may load cookieless, this withholds the tag itself — the loader string
+ * is only ever reached once `trackingGranted` is true, either because a returning visitor's stored
+ * record already says so, or because `applyConsent` later dispatches {@link CONSENT_EVENT} with
+ * one that does. The listener removes itself on the first passing event, so the loader — which
+ * marks its own element and refuses to run twice — is asked to run at most once from here.
+ *
+ * `loaderExpr` is a complete statement or expression that runs the loader when reached — the
+ * self-invoking IIFE string `googleTagHeadScript`'s `gtagScript`/`gtmContainerScript` already
+ * produce, embedded here verbatim rather than called. It is placed inline exactly as
+ * `consentBootstrapScript`'s own output is: dynamic values (the storage key, the category shape,
+ * the event name) are JSON-encoded so nothing configured can break out of a string literal, and
+ * escaping the RESULT for HTML (`</script`, `<!--`) is left to whoever composes the final inline
+ * script — the same discipline `consentBootstrapScript` follows, and `googleTagHeadScript` already
+ * applies to the whole script it stamps.
+ */
+export declare const consentGateScript: (loaderExpr: string, opts?: ConsentOptions & {
+    categories?: ConsentCategory[];
+}) => string;
 //# sourceMappingURL=gtm.d.ts.map

package/build/gtm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gtm.d.ts","sourceRoot":"","sources":["../src/gtm.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAUhF;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,GAAG,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,CAUrD;AAKD,8EAA8E;AAC9E,eAAO,MAAM,eAAe,gBACb,eAAe,EAAE,KAC7B,MAAM,CAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,CAMrC,CAAA;AAED,sDAAsD;AACtD,eAAO,MAAM,aAAa,WAChB,aAAa,eAAe,eAAe,EAAE,KACpD,MAAM,CAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,CAWrC,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,UAAW,cAAc,KAAG,IAO3D,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,YAAY,WAAY,aAAa,SAAS,cAAc,KAAG,IAqB3E,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,UAAW,cAAc,KAAG,MAwB9D,CAAA"}
+{"version":3,"file":"gtm.d.ts","sourceRoot":"","sources":["../src/gtm.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAUhF;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,GAAG,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,CAUrD;AAKD,8EAA8E;AAC9E,eAAO,MAAM,eAAe,gBACb,eAAe,EAAE,KAC7B,MAAM,CAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,CAMrC,CAAA;AAED,sDAAsD;AACtD,eAAO,MAAM,aAAa,WAChB,aAAa,eAAe,eAAe,EAAE,KACpD,MAAM,CAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,CAWrC,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,UAAW,cAAc,KAAG,IAO3D,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,YAAY,WAAY,aAAa,SAAS,cAAc,KAAG,IA6B3E,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,WAClB,aAAa,GAAG,IAAI,eAAc,eAAe,EAAE,KAC1D,OAEF,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,UAAW,cAAc,KAAG,MAwB9D,CAAA;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,iBAAiB,eAChB,MAAM,SAAS,cAAc,GAAG;IAAE,UAAU,CAAC,EAAE,eAAe,EAAE,CAAA;CAAE,KAC7E,MAuBF,CAAA"}

package/build/gtm.js

@@ -1,4 +1,4 @@
-import { CONSENT_KEY, CONSENT_SETUP_FLAG, CONSENT_SIGNAL_DEFAULTS, DEFAULT_CONSENT_CATEGORIES, } from './consts.js';
+import { CONSENT_EVENT, CONSENT_KEY, CONSENT_SETUP_FLAG, CONSENT_SIGNAL_DEFAULTS, DEFAULT_CONSENT_CATEGORIES, } from './consts.js';
 const global = () => typeof window !== 'undefined' ? window : null;
 /**
  * Push onto the tag-manager queue in the shape Google's own snippet uses.
@@ -77,7 +77,24 @@ export const applyConsent = (record, opts) => {
             win.dataLayer.push({ event: category.event });
         }
     }
+    // A gate script (`consentGateScript`) that already decided NOT to load, because nothing was
+    // granted at the time it ran, has no other way to hear this. Consent Mode itself speaks only on
+    // `dataLayer`, which a tag that never loaded is not listening to.
+    if (typeof window !== 'undefined' && typeof window.dispatchEvent === 'function'
+        && typeof CustomEvent === 'function') {
+        window.dispatchEvent(new CustomEvent(CONSENT_EVENT, { detail: { record } }));
+    }
 };
+/**
+ * Whether a stored decision grants tracking at all — a signal-bearing category, not merely the
+ * required essential one.
+ *
+ * "Signal-bearing" is what a required category can never be: it exists to gate whether a LOADER
+ * runs, and a required category is disclosure, not a question — everyone gets it. Only a category
+ * that both is optional and drives at least one Consent Mode signal counts, which is exactly what
+ * `googleTagHeadScript`'s `'basic'` mode gates a Google tag behind.
+ */
+export const trackingGranted = (record, categories = DEFAULT_CONSENT_CATEGORIES) => record != null && categories.some(category => !category.required && (category.signals?.length ?? 0) > 0 && record[category.key] === true);
 /**
  * The inline script a document stamps ABOVE its tag-manager snippet.
  *
@@ -111,4 +128,47 @@ export const consentBootstrapScript = (opts) => {
         `u[s]=ok&&u[s]!=='denied'?'granted':'denied'}}` +
         `g('consent','update',u)})(window,document)`;
 };
+/**
+ * Withhold a loader until a stored or later decision grants tracking.
+ *
+ * The counterpart to `consentBootstrapScript` for the `'basic'` gated loading mode
+ * (`@owlmeans/web-gtm`'s `GOOGLE_TAG_DEFAULT_MODE`): where the bootstrap always declares Consent
+ * Mode's defaults so a tag may load cookieless, this withholds the tag itself — the loader string
+ * is only ever reached once `trackingGranted` is true, either because a returning visitor's stored
+ * record already says so, or because `applyConsent` later dispatches {@link CONSENT_EVENT} with
+ * one that does. The listener removes itself on the first passing event, so the loader — which
+ * marks its own element and refuses to run twice — is asked to run at most once from here.
+ *
+ * `loaderExpr` is a complete statement or expression that runs the loader when reached — the
+ * self-invoking IIFE string `googleTagHeadScript`'s `gtagScript`/`gtmContainerScript` already
+ * produce, embedded here verbatim rather than called. It is placed inline exactly as
+ * `consentBootstrapScript`'s own output is: dynamic values (the storage key, the category shape,
+ * the event name) are JSON-encoded so nothing configured can break out of a string literal, and
+ * escaping the RESULT for HTML (`</script`, `<!--`) is left to whoever composes the final inline
+ * script — the same discipline `consentBootstrapScript` follows, and `googleTagHeadScript` already
+ * applies to the whole script it stamps.
+ */
+export const consentGateScript = (loaderExpr, opts) => {
+    const gate = JSON.stringify(categoriesOf(opts).map(category => ({
+        key: category.key,
+        required: category.required === true,
+        hasSignal: (category.signals ?? []).length > 0,
+    })));
+    const storageKey = JSON.stringify(opts?.storageKey ?? CONSENT_KEY);
+    const event = JSON.stringify(CONSENT_EVENT);
+    return `(function(w,d){` +
+        `function ok(r){if(!r)return false;var cs=${gate};` +
+        `for(var i=0;i<cs.length;i++){var c=cs[i];` +
+        `if(!c.required&&c.hasSignal&&r[c.key]===true)return true}return false}` +
+        `function load(){${loaderExpr}}` +
+        `var raw=null;try{raw=w.localStorage.getItem(${storageKey})}catch(e){}` +
+        `if(!raw){var p=('; '+d.cookie).split('; '+${storageKey}+'=');` +
+        `if(p.length===2){raw=p.pop().split(';').shift()}}` +
+        `var r=null;if(raw){try{r=JSON.parse(raw)}catch(e){r=null}}` +
+        `if(ok(r)){load();return}` +
+        `function h(ev){if(ok(ev&&ev.detail&&ev.detail.record)){` +
+        `w.removeEventListener(${event},h);load()}}` +
+        `w.addEventListener(${event},h)` +
+        `})(window,document)`;
+};
 //# sourceMappingURL=gtm.js.map

package/build/gtm.js.map

@@ -1 +1 @@
-{"version":3,"file":"gtm.js","sourceRoot":"","sources":["../src/gtm.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,0BAA0B,GACrF,MAAM,aAAa,CAAA;AAQpB,MAAM,MAAM,GAAG,GAAyB,EAAE,CACxC,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAkC,CAAC,CAAC,CAAC,IAAI,CAAA;AAE3E;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,GAAG,KAAgB;IAC7C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;IACpB,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAChB,OAAM;IACR,CAAC;IACD,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,EAAE,CAAA;IACnC,iGAAiG;IACjG,iDAAiD;IACjD,8CAA8C;IAC9C,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AAC/B,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,IAAqB,EAAqB,EAAE,CAChE,IAAI,EAAE,UAAU,IAAI,0BAA0B,CAAA;AAEhD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,UAA8B,EACQ,EAAE;IACxC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,IAAI,0BAA0B,CAAC;SAC5D,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAA;IAE/C,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC;SAC9D,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAe,CAAC,CAAC,CAAC,CAAA;AACrD,CAAC,CAAA;AAED,sDAAsD;AACtD,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,MAAqB,EAAE,UAA8B,EACf,EAAE;IACxC,MAAM,MAAM,GAAyC,EAAE,CAAA;IACvD,KAAK,MAAM,QAAQ,IAAI,UAAU,IAAI,0BAA0B,EAAE,CAAC;QAChE,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,IAAI,CAAA;QAC3E,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YAC5C,8EAA8E;YAC9E,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAA;QAChF,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,IAAqB,EAAQ,EAAE;IACjE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;IACpB,IAAI,GAAG,IAAI,IAAI,IAAI,IAAI,EAAE,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,kBAAkB,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7E,OAAM;IACR,CAAC;IACD,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACtE,GAAG,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAA;AAChC,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAqB,EAAE,IAAqB,EAAQ,EAAE;IACjF,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;IACpB,IAAI,GAAG,IAAI,IAAI,IAAI,IAAI,EAAE,MAAM,KAAK,IAAI,EAAE,CAAC;QACzC,OAAM;IACR,CAAC;IACD,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IAErC,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,IAAI,QAAQ,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;YAC/B,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,QAAQ,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,IAAI,CAAA;QACvF,CAAC;IACH,CAAC;IAED,WAAW,CAAC,SAAS,EAAE,QAAQ,EAAE,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAA;IAEnE,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,IAAI,QAAQ,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YAC5F,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,EAAE,CAAA;YACnC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;QAC/C,CAAC;IACH,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,IAAqB,EAAU,EAAE;IACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACpE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACpE,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,KAAK,IAAI;QACpC,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,EAAE;QAC/B,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,IAAI;KACtC,CAAC,CAAC,CAAC,CAAA;IACJ,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,IAAI,WAAW,CAAC,CAAA;IAClE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAA;IAE/C,OAAO,iBAAiB;QACtB,uEAAuE;QACvE,QAAQ,IAAI,kCAAkC,QAAQ,OAAO,IAAI,SAAS;QAC1E,+CAA+C,UAAU,cAAc;QACvE,6CAA6C,UAAU,QAAQ;QAC/D,mDAAmD;QACnD,6DAA6D;QAC7D,UAAU,UAAU,QAAQ;QAC5B,8EAA8E;QAC9E,oCAAoC;QACpC,yDAAyD;QACzD,+CAA+C;QAC/C,4CAA4C,CAAA;AAChD,CAAC,CAAA"}
+{"version":3,"file":"gtm.js","sourceRoot":"","sources":["../src/gtm.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EAAE,WAAW,EAAE,kBAAkB,EAAE,uBAAuB,EACvE,0BAA0B,GAC3B,MAAM,aAAa,CAAA;AAQpB,MAAM,MAAM,GAAG,GAAyB,EAAE,CACxC,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAkC,CAAC,CAAC,CAAC,IAAI,CAAA;AAE3E;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,GAAG,KAAgB;IAC7C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;IACpB,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAChB,OAAM;IACR,CAAC;IACD,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,EAAE,CAAA;IACnC,iGAAiG;IACjG,iDAAiD;IACjD,8CAA8C;IAC9C,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AAC/B,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,IAAqB,EAAqB,EAAE,CAChE,IAAI,EAAE,UAAU,IAAI,0BAA0B,CAAA;AAEhD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,UAA8B,EACQ,EAAE;IACxC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,IAAI,0BAA0B,CAAC;SAC5D,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAA;IAE/C,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC;SAC9D,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAe,CAAC,CAAC,CAAC,CAAA;AACrD,CAAC,CAAA;AAED,sDAAsD;AACtD,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,MAAqB,EAAE,UAA8B,EACf,EAAE;IACxC,MAAM,MAAM,GAAyC,EAAE,CAAA;IACvD,KAAK,MAAM,QAAQ,IAAI,UAAU,IAAI,0BAA0B,EAAE,CAAC;QAChE,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,IAAI,CAAA;QAC3E,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YAC5C,8EAA8E;YAC9E,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAA;QAChF,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,IAAqB,EAAQ,EAAE;IACjE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;IACpB,IAAI,GAAG,IAAI,IAAI,IAAI,IAAI,EAAE,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,kBAAkB,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7E,OAAM;IACR,CAAC;IACD,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACtE,GAAG,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAA;AAChC,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAqB,EAAE,IAAqB,EAAQ,EAAE;IACjF,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;IACpB,IAAI,GAAG,IAAI,IAAI,IAAI,IAAI,EAAE,MAAM,KAAK,IAAI,EAAE,CAAC;QACzC,OAAM;IACR,CAAC;IACD,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IAErC,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,IAAI,QAAQ,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;YAC/B,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,QAAQ,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,IAAI,CAAA;QACvF,CAAC;IACH,CAAC;IAED,WAAW,CAAC,SAAS,EAAE,QAAQ,EAAE,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAA;IAEnE,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,IAAI,QAAQ,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YAC5F,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,EAAE,CAAA;YACnC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;QAC/C,CAAC;IACH,CAAC;IAED,4FAA4F;IAC5F,gGAAgG;IAChG,kEAAkE;IAClE,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,UAAU;WAC1E,OAAO,WAAW,KAAK,UAAU,EAAE,CAAC;QACvC,MAAM,CAAC,aAAa,CAAC,IAAI,WAAW,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAA;IAC9E,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,MAA4B,EAAE,UAAU,GAAsB,0BAA0B,EAC/E,EAAE,CAAC,MAAM,IAAI,IAAI,IAAI,UAAU,CAAC,IAAI,CAC7C,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,IAAI,CACvG,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,IAAqB,EAAU,EAAE;IACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACpE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACpE,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,KAAK,IAAI;QACpC,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,EAAE;QAC/B,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,IAAI;KACtC,CAAC,CAAC,CAAC,CAAA;IACJ,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,IAAI,WAAW,CAAC,CAAA;IAClE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAA;IAE/C,OAAO,iBAAiB;QACtB,uEAAuE;QACvE,QAAQ,IAAI,kCAAkC,QAAQ,OAAO,IAAI,SAAS;QAC1E,+CAA+C,UAAU,cAAc;QACvE,6CAA6C,UAAU,QAAQ;QAC/D,mDAAmD;QACnD,6DAA6D;QAC7D,UAAU,UAAU,QAAQ;QAC5B,8EAA8E;QAC9E,oCAAoC;QACpC,yDAAyD;QACzD,+CAA+C;QAC/C,4CAA4C,CAAA;AAChD,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,UAAkB,EAAE,IAA0D,EACtE,EAAE;IACV,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC9D,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,KAAK,IAAI;QACpC,SAAS,EAAE,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;KAC/C,CAAC,CAAC,CAAC,CAAA;IACJ,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,IAAI,WAAW,CAAC,CAAA;IAClE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;IAE3C,OAAO,iBAAiB;QACtB,4CAA4C,IAAI,GAAG;QACnD,2CAA2C;QAC3C,wEAAwE;QACxE,mBAAmB,UAAU,GAAG;QAChC,+CAA+C,UAAU,cAAc;QACvE,6CAA6C,UAAU,QAAQ;QAC/D,mDAAmD;QACnD,4DAA4D;QAC5D,0BAA0B;QAC1B,yDAAyD;QACzD,yBAAyB,KAAK,cAAc;QAC5C,sBAAsB,KAAK,KAAK;QAChC,qBAAqB,CAAA;AACzB,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/consent",
-  "version": "0.1.18-rc.5",
+  "version": "0.1.18-rc.6",
   "license": "MIT",
   "type": "module",
   "scripts": {

package/src/consts.ts

@@ -22,6 +22,17 @@ export const CONSENT_SCHEMA_VERSION = 2
 /** Idempotence flag for the Consent Mode defaults. Fixed: a page may carry two bundles. */
 export const CONSENT_SETUP_FLAG = 'cookieConsentSetup'
 
+/**
+ * The DOM event `applyConsent` dispatches on `window` after it finishes writing globals and
+ * pushing the Consent Mode update.
+ *
+ * A loader that already ran (a gate script that decided, on first paint, not to load yet) has no
+ * other way to hear a LATER grant — Consent Mode itself speaks only on `window.dataLayer`, which a
+ * tag that has not loaded is not listening to. `event.detail.record` carries the record that was
+ * just applied.
+ */
+export const CONSENT_EVENT = 'owlmeans:consent'
+
 export const CONSENT_ESSENTIAL = 'essential'
 export const CONSENT_ANALYTICS = 'analytics'
 export const CONSENT_MARKETING = 'marketing'

package/src/gtm.ts

@@ -1,5 +1,6 @@
 import {
-  CONSENT_KEY, CONSENT_SETUP_FLAG, CONSENT_SIGNAL_DEFAULTS, DEFAULT_CONSENT_CATEGORIES,
+  CONSENT_EVENT, CONSENT_KEY, CONSENT_SETUP_FLAG, CONSENT_SIGNAL_DEFAULTS,
+  DEFAULT_CONSENT_CATEGORIES,
 } from './consts.js'
 import type { ConsentCategory, ConsentOptions, ConsentRecord } from './types.js'
 
@@ -103,8 +104,31 @@ export const applyConsent = (record: ConsentRecord, opts?: ConsentOptions): void
       win.dataLayer.push({ event: category.event })
     }
   }
+
+  // A gate script (`consentGateScript`) that already decided NOT to load, because nothing was
+  // granted at the time it ran, has no other way to hear this. Consent Mode itself speaks only on
+  // `dataLayer`, which a tag that never loaded is not listening to.
+  if (typeof window !== 'undefined' && typeof window.dispatchEvent === 'function'
+    && typeof CustomEvent === 'function') {
+    window.dispatchEvent(new CustomEvent(CONSENT_EVENT, { detail: { record } }))
+  }
 }
 
+/**
+ * Whether a stored decision grants tracking at all — a signal-bearing category, not merely the
+ * required essential one.
+ *
+ * "Signal-bearing" is what a required category can never be: it exists to gate whether a LOADER
+ * runs, and a required category is disclosure, not a question — everyone gets it. Only a category
+ * that both is optional and drives at least one Consent Mode signal counts, which is exactly what
+ * `googleTagHeadScript`'s `'basic'` mode gates a Google tag behind.
+ */
+export const trackingGranted = (
+  record: ConsentRecord | null, categories: ConsentCategory[] = DEFAULT_CONSENT_CATEGORIES
+): boolean => record != null && categories.some(
+  category => !category.required && (category.signals?.length ?? 0) > 0 && record[category.key] === true
+)
+
 /**
  * The inline script a document stamps ABOVE its tag-manager snippet.
  *
@@ -139,3 +163,50 @@ export const consentBootstrapScript = (opts?: ConsentOptions): string => {
     `u[s]=ok&&u[s]!=='denied'?'granted':'denied'}}` +
     `g('consent','update',u)})(window,document)`
 }
+
+/**
+ * Withhold a loader until a stored or later decision grants tracking.
+ *
+ * The counterpart to `consentBootstrapScript` for the `'basic'` gated loading mode
+ * (`@owlmeans/web-gtm`'s `GOOGLE_TAG_DEFAULT_MODE`): where the bootstrap always declares Consent
+ * Mode's defaults so a tag may load cookieless, this withholds the tag itself — the loader string
+ * is only ever reached once `trackingGranted` is true, either because a returning visitor's stored
+ * record already says so, or because `applyConsent` later dispatches {@link CONSENT_EVENT} with
+ * one that does. The listener removes itself on the first passing event, so the loader — which
+ * marks its own element and refuses to run twice — is asked to run at most once from here.
+ *
+ * `loaderExpr` is a complete statement or expression that runs the loader when reached — the
+ * self-invoking IIFE string `googleTagHeadScript`'s `gtagScript`/`gtmContainerScript` already
+ * produce, embedded here verbatim rather than called. It is placed inline exactly as
+ * `consentBootstrapScript`'s own output is: dynamic values (the storage key, the category shape,
+ * the event name) are JSON-encoded so nothing configured can break out of a string literal, and
+ * escaping the RESULT for HTML (`</script`, `<!--`) is left to whoever composes the final inline
+ * script — the same discipline `consentBootstrapScript` follows, and `googleTagHeadScript` already
+ * applies to the whole script it stamps.
+ */
+export const consentGateScript = (
+  loaderExpr: string, opts?: ConsentOptions & { categories?: ConsentCategory[] }
+): string => {
+  const gate = JSON.stringify(categoriesOf(opts).map(category => ({
+    key: category.key,
+    required: category.required === true,
+    hasSignal: (category.signals ?? []).length > 0,
+  })))
+  const storageKey = JSON.stringify(opts?.storageKey ?? CONSENT_KEY)
+  const event = JSON.stringify(CONSENT_EVENT)
+
+  return `(function(w,d){` +
+    `function ok(r){if(!r)return false;var cs=${gate};` +
+    `for(var i=0;i<cs.length;i++){var c=cs[i];` +
+    `if(!c.required&&c.hasSignal&&r[c.key]===true)return true}return false}` +
+    `function load(){${loaderExpr}}` +
+    `var raw=null;try{raw=w.localStorage.getItem(${storageKey})}catch(e){}` +
+    `if(!raw){var p=('; '+d.cookie).split('; '+${storageKey}+'=');` +
+    `if(p.length===2){raw=p.pop().split(';').shift()}}` +
+    `var r=null;if(raw){try{r=JSON.parse(raw)}catch(e){r=null}}` +
+    `if(ok(r)){load();return}` +
+    `function h(ev){if(ok(ev&&ev.detail&&ev.detail.record)){` +
+    `w.removeEventListener(${event},h);load()}}` +
+    `w.addEventListener(${event},h)` +
+    `})(window,document)`
+}

package/tests/consent.spec.ts

@@ -1,10 +1,10 @@
 import { describe, test, expect, beforeEach } from 'bun:test'
 import {
-  CONSENT_ANALYTICS, CONSENT_ESSENTIAL, CONSENT_KEY, CONSENT_LOCALES, CONSENT_MARKETING,
-  CONSENT_SCHEMA_VERSION, DEFAULT_CONSENT_CATEGORIES,
+  CONSENT_ANALYTICS, CONSENT_ESSENTIAL, CONSENT_EVENT, CONSENT_KEY, CONSENT_LOCALES,
+  CONSENT_MARKETING, CONSENT_SCHEMA_VERSION, DEFAULT_CONSENT_CATEGORIES,
 } from '../src/consts.js'
 import { migrateConsent, readConsent, writeConsent, clearConsent } from '../src/storage.js'
-import { consentDefaults, consentUpdate, consentBootstrapScript } from '../src/gtm.js'
+import { applyConsent, consentDefaults, consentUpdate, consentBootstrapScript } from '../src/gtm.js'
 import { makeConsentStore } from '../src/store.js'
 import {
   DEFAULT_CONSENT_MESSAGES, defaultConsentTranslate, interpolate, normalizeLocale,
@@ -117,6 +117,36 @@ describe('consent mode signals', () => {
   })
 })
 
+describe('applyConsent dispatches a DOM event', () => {
+  test('fires CONSENT_EVENT with the record after writing globals and pushing the update', () => {
+    const seen: unknown[] = []
+    const listener = (event: Event) => { seen.push((event as CustomEvent).detail) }
+    ;(globalThis as any).addEventListener(CONSENT_EVENT, listener)
+
+    try {
+      applyConsent({ [CONSENT_ANALYTICS]: true })
+
+      expect(seen).toEqual([{ record: { [CONSENT_ANALYTICS]: true } }])
+    } finally {
+      ;(globalThis as any).removeEventListener(CONSENT_EVENT, listener)
+    }
+  })
+
+  test('silent mode dispatches nothing', () => {
+    const seen: unknown[] = []
+    const listener = (event: Event) => { seen.push((event as CustomEvent).detail) }
+    ;(globalThis as any).addEventListener(CONSENT_EVENT, listener)
+
+    try {
+      applyConsent({ [CONSENT_ANALYTICS]: true }, { silent: true })
+
+      expect(seen).toEqual([])
+    } finally {
+      ;(globalThis as any).removeEventListener(CONSENT_EVENT, listener)
+    }
+  })
+})
+
 describe('the bootstrap script', () => {
   const script = consentBootstrapScript()
 

package/tests/tracking.spec.ts

@@ -0,0 +1,191 @@
+import { describe, test, expect } from 'bun:test'
+import { CONSENT_ANALYTICS, CONSENT_ESSENTIAL, CONSENT_EVENT, CONSENT_KEY, CONSENT_MARKETING } from '../src/consts.js'
+import { consentGateScript, trackingGranted } from '../src/gtm.js'
+import type { ConsentCategory, ConsentRecord } from '../src/types.js'
+
+describe('trackingGranted', () => {
+  test('no record at all is not granted', () => {
+    expect(trackingGranted(null)).toBe(false)
+  })
+
+  test('an essential-only record is not granted — required categories never count', () => {
+    const record: ConsentRecord = {
+      [CONSENT_ESSENTIAL]: true, [CONSENT_ANALYTICS]: false, [CONSENT_MARKETING]: false,
+    }
+
+    expect(trackingGranted(record)).toBe(false)
+  })
+
+  test('analytics granted is tracking-granted', () => {
+    const record: ConsentRecord = { [CONSENT_ESSENTIAL]: true, [CONSENT_ANALYTICS]: true }
+
+    expect(trackingGranted(record)).toBe(true)
+  })
+
+  test('marketing granted is tracking-granted too', () => {
+    const record: ConsentRecord = { [CONSENT_ESSENTIAL]: true, [CONSENT_MARKETING]: true }
+
+    expect(trackingGranted(record)).toBe(true)
+  })
+
+  test('a required category is ignored even when the record marks it granted', () => {
+    // A category can be BOTH required and signal-bearing (`essential` drives security_storage /
+    // functionality_storage by default) — required must still veto it, because everyone gets it
+    // regardless of what the record says.
+    const categories: ConsentCategory[] = [
+      {
+        key: 'essential', required: true, labelKey: 'a', descriptionKey: 'b',
+        signals: ['security_storage'],
+      },
+    ]
+
+    expect(trackingGranted({ essential: true }, categories)).toBe(false)
+  })
+
+  test('a category with no signals is ignored even when granted', () => {
+    const categories: ConsentCategory[] = [
+      { key: 'preferences', labelKey: 'a', descriptionKey: 'b' },
+    ]
+
+    expect(trackingGranted({ preferences: true }, categories)).toBe(false)
+  })
+})
+
+describe('consentGateScript — the two reachable paths', () => {
+  /** A minimal window/document the generated script can run against, with an event bus. */
+  const makeBrowser = (stored?: { key?: string, record: Record<string, unknown> }) => {
+    const storage = new Map<string, string>()
+    if (stored != null) {
+      storage.set(stored.key ?? CONSENT_KEY, JSON.stringify(stored.record))
+    }
+    const listeners = new Map<string, ((event: unknown) => void)[]>()
+    const win: Record<string, unknown> & {
+      addEventListener: (type: string, cb: (event: unknown) => void) => void
+      removeEventListener: (type: string, cb: (event: unknown) => void) => void
+    } = {
+      localStorage: { getItem: (k: string) => storage.get(k) ?? null },
+      addEventListener: (type, cb) => {
+        listeners.set(type, [...(listeners.get(type) ?? []), cb])
+      },
+      removeEventListener: (type, cb) => {
+        listeners.set(type, (listeners.get(type) ?? []).filter(listener => listener !== cb))
+      },
+    }
+    const doc = { cookie: '' }
+
+    return {
+      win,
+      run: (script: string) => {
+        // eslint-disable-next-line no-new-func
+        new Function('window', 'document', script)(win, doc)
+      },
+      dispatch: (detail: unknown) => {
+        for (const cb of listeners.get(CONSENT_EVENT) ?? []) {
+          cb({ detail })
+        }
+      },
+      listenerCount: () => listeners.get(CONSENT_EVENT)?.length ?? 0,
+    }
+  }
+
+  test('a returning visitor with a stored grant runs the loader immediately, synchronously', () => {
+    const browser = makeBrowser({ record: { essential: true, analytics: true, v: 2 } })
+    browser.win.__loaded = 0
+    browser.run(consentGateScript('window.__loaded = (window.__loaded || 0) + 1'))
+
+    expect(browser.win.__loaded).toBe(1)
+    // Nothing left listening — the immediate branch never subscribes.
+    expect(browser.listenerCount()).toBe(0)
+  })
+
+  test('a stored record that grants nothing does not run the loader immediately', () => {
+    const browser = makeBrowser({ record: { essential: true, analytics: false, v: 2 } })
+    browser.win.__loaded = 0
+    browser.run(consentGateScript('window.__loaded = (window.__loaded || 0) + 1'))
+
+    expect(browser.win.__loaded).toBe(0)
+    expect(browser.listenerCount()).toBe(1)
+  })
+
+  test('no stored record at all falls to the event-listener branch and waits', () => {
+    const browser = makeBrowser()
+    browser.win.__loaded = 0
+    browser.run(consentGateScript('window.__loaded = (window.__loaded || 0) + 1'))
+
+    expect(browser.win.__loaded).toBe(0)
+
+    // A denying event changes nothing.
+    browser.dispatch({ record: { essential: true, analytics: false } })
+    expect(browser.win.__loaded).toBe(0)
+
+    // The first granting event runs the loader and removes the listener.
+    browser.dispatch({ record: { essential: true, analytics: true } })
+    expect(browser.win.__loaded).toBe(1)
+    expect(browser.listenerCount()).toBe(0)
+
+    // A later event does nothing further — the listener already removed itself.
+    browser.dispatch({ record: { essential: true, analytics: true } })
+    expect(browser.win.__loaded).toBe(1)
+  })
+
+  test('the cookie answers when localStorage has nothing stored', () => {
+    // Same fallback order `consentBootstrapScript`/`readConsent` use: localStorage first, the
+    // cookie second. Simulated here by handing the script a `document` whose cookie carries the
+    // record and a `window` whose localStorage is empty.
+    const record = JSON.stringify({ essential: true, analytics: true, v: 2 })
+    const win: Record<string, unknown> & {
+      addEventListener: (type: string, cb: (event: unknown) => void) => void
+      removeEventListener: (type: string, cb: (event: unknown) => void) => void
+    } = {
+      localStorage: { getItem: () => null },
+      addEventListener: () => {},
+      removeEventListener: () => {},
+      __loaded: 0,
+    }
+    const doc = { cookie: `${CONSENT_KEY}=${record}` }
+    // eslint-disable-next-line no-new-func
+    new Function(
+      'window', 'document', consentGateScript('window.__loaded = (window.__loaded || 0) + 1')
+    )(win, doc)
+
+    expect(win.__loaded).toBe(1)
+  })
+
+  test('only a signal-bearing, non-required category can satisfy the gate', () => {
+    const categories: ConsentCategory[] = [
+      { key: 'essential', required: true, labelKey: 'a', descriptionKey: 'b', signals: ['security_storage'] },
+      { key: 'analytics', labelKey: 'c', descriptionKey: 'd', signals: ['analytics_storage'] },
+    ]
+    const browser = makeBrowser({ record: { essential: true, analytics: false, v: 2 } })
+    browser.win.__loaded = 0
+    browser.run(consentGateScript('window.__loaded = (window.__loaded || 0) + 1', { categories }))
+
+    expect(browser.win.__loaded).toBe(0)
+
+    browser.dispatch({ record: { essential: true, analytics: true } })
+    expect(browser.win.__loaded).toBe(1)
+  })
+
+  test('the generated script carries both reachable code paths in its text', () => {
+    const script = consentGateScript('window.__loaded = (window.__loaded || 0) + 1')
+
+    // The immediate branch: `load()` called right after the stored-record check, before any
+    // listener is attached.
+    expect(script.indexOf('load()')).toBeLessThan(script.indexOf('addEventListener'))
+    // The event-listener branch: the same loader, reachable a second time from inside the handler
+    // — plus the `function load(){...}` declaration itself, three occurrences of `load()` in all.
+    expect(script.match(/load\(\)/g)?.length).toBe(3)
+    expect(script).toContain(JSON.stringify(CONSENT_EVENT))
+    expect(script).toContain(JSON.stringify(CONSENT_KEY))
+  })
+
+  test('a custom storage key is honoured, matching the bootstrap script\'s own lookup', () => {
+    const browser = makeBrowser({ key: 'custom_key', record: { essential: true, analytics: true, v: 2 } })
+    browser.win.__loaded = 0
+    browser.run(consentGateScript(
+      'window.__loaded = (window.__loaded || 0) + 1', { storageKey: 'custom_key' }
+    ))
+
+    expect(browser.win.__loaded).toBe(1)
+  })
+})