@owlmeans/consent 0.1.18-rc.9 → 0.1.18

package/tests/linker.spec.ts

@@ -1,16 +1,10 @@
 import { describe, test, expect, beforeEach, afterEach } from 'bun:test'
-import {
-  CONSENT_ANALYTICS, CONSENT_ESSENTIAL, CONSENT_KEY, CONSENT_LANGUAGE_KEY, CONSENT_MARKETING,
-  DEFAULT_CONSENT_CATEGORIES,
-} from '../src/consts.js'
-import { consentBootstrapScript } from '../src/gtm.js'
-import {
-  consentLinker, consentLinkerScript, decodeConsentLink, encodeConsentLink, stripConsentLinkParam, writeConsentLanguage,
-  CONSENT_LINK_MAX_AGE, CONSENT_LINK_PARAM,
-} from '../src/linker.js'
-import { adoptConsentLanguage, consentDomains, decorateConsentUrl, registerConsentPlugin } from '../src/plugins.js'
+import { CONSENT_ANALYTICS, CONSENT_ESSENTIAL, CONSENT_KEY, CONSENT_LANGUAGE_KEY, CONSENT_MARKETING, DEFAULT_CONSENT_CATEGORIES, CONSENT_LINK_MAX_AGE, CONSENT_LINK_PARAM } from '../src/consts.js'
+import { consentModeHelper } from '../src/gtobserver.js'
+import { consentLinkHelper } from '../src/linker.js'
+import { consentPluginHelper } from '../src/plugins.js'
 import { makeConsentStore } from '../src/store.js'
-import { readConsent, writeConsent } from '../src/storage.js'
+import { consentStorageHelper } from '../src/storage.js'
 import type { ConsentRecord } from '../src/types.js'
 
 /** A minimal browser: storage, a settable referrer, and a `location`/`history` pair that actually
@@ -78,8 +72,8 @@ beforeEach(() => {
 describe('encodeConsentLink / decodeConsentLink', () => {
   test('round-trips a record through the optional categories only', () => {
     const record: ConsentRecord = { [CONSENT_ESSENTIAL]: true, [CONSENT_ANALYTICS]: true, [CONSENT_MARKETING]: false }
-    const encoded = encodeConsentLink(record)
-    const decoded = decodeConsentLink(encoded)
+    const encoded = consentLinkHelper.encodeConsentLink(record)
+    const decoded = consentLinkHelper.decodeConsentLink(encoded)
 
     expect(decoded?.v).toBe(2)
     expect(decoded?.c).toEqual({ [CONSENT_ANALYTICS]: 1, [CONSENT_MARKETING]: 0 })
@@ -87,26 +81,26 @@ describe('encodeConsentLink / decodeConsentLink', () => {
   })
 
   test('rejects garbage rather than throwing', () => {
-    expect(decodeConsentLink('not-base64url-json')).toBeNull()
-    expect(decodeConsentLink('')).toBeNull()
+    expect(consentLinkHelper.decodeConsentLink('not-base64url-json')).toBeNull()
+    expect(consentLinkHelper.decodeConsentLink('')).toBeNull()
   })
 
   test('rejects a payload of the wrong version', () => {
     const bad = Buffer.from(JSON.stringify({ v: 1, c: {}, t: nowSeconds() })).toString('base64url')
 
-    expect(decodeConsentLink(bad)).toBeNull()
+    expect(consentLinkHelper.decodeConsentLink(bad)).toBeNull()
   })
 })
 
 describe('consentLinker().decorate', () => {
-  const plugin = consentLinker()
+  const plugin = consentLinkHelper.consentLinker()
   const record: ConsentRecord = { [CONSENT_ESSENTIAL]: true, [CONSENT_ANALYTICS]: true, [CONSENT_MARKETING]: false }
 
   test('decorates a listed, foreign host', () => {
     const decorated = plugin.decorate!(new URL('https://site.test/legal/cookies'), record, linkerOpts)
 
     expect(decorated).not.toBeNull()
-    const payload = decodeConsentLink(decorated!.searchParams.get(CONSENT_LINK_PARAM)!)
+    const payload = consentLinkHelper.decodeConsentLink(decorated!.searchParams.get(CONSENT_LINK_PARAM)!)
     expect(payload?.c[CONSENT_ANALYTICS]).toBe(1)
   })
 
@@ -132,8 +126,8 @@ describe('consentLinker().decorate', () => {
 })
 
 describe('consentLinker().adopt — every trust rule', () => {
-  const plugin = consentLinker()
-  const valid = () => encodeConsentLink({ [CONSENT_ANALYTICS]: true, [CONSENT_MARKETING]: false })
+  const plugin = consentLinkHelper.consentLinker()
+  const valid = () => consentLinkHelper.encodeConsentLink({ [CONSENT_ANALYTICS]: true, [CONSENT_MARKETING]: false })
 
   test('adopts a fresh, referred, fully-covered decision', () => {
     env.goto(`https://platform.test/dispatcher?owlcc=${valid()}`, 'https://site.test/')
@@ -199,21 +193,21 @@ describe('consentLinker().adopt — every trust rule', () => {
 describe('stripConsentLinkParam', () => {
   test('removes only the parameter, keeping the rest and the hash', () => {
     env.goto('https://platform.test/dispatcher?owlcc=abc&next=%2Fhome&ref=site#panel')
-    stripConsentLinkParam(linkerOpts)
+    consentLinkHelper.stripConsentLinkParam(linkerOpts)
 
     expect(env.href()).toBe('https://platform.test/dispatcher?next=%2Fhome&ref=site#panel')
   })
 
   test('is a no-op with no parameter present', () => {
     env.goto('https://platform.test/dispatcher?next=%2Fhome')
-    stripConsentLinkParam(linkerOpts)
+    consentLinkHelper.stripConsentLinkParam(linkerOpts)
 
     expect(env.href()).toBe('https://platform.test/dispatcher?next=%2Fhome')
   })
 
   test('is a no-op with no linker configured', () => {
     env.goto('https://platform.test/dispatcher?owlcc=abc')
-    stripConsentLinkParam({})
+    consentLinkHelper.stripConsentLinkParam({})
 
     expect(env.href()).toBe('https://platform.test/dispatcher?owlcc=abc')
   })
@@ -221,8 +215,8 @@ describe('stripConsentLinkParam', () => {
 
 describe('consentDomains / decorateConsentUrl (registry level)', () => {
   test('discloses the current host plus every plugin-named domain, deduplicated', () => {
-    registerConsentPlugin(consentLinker())
-    const domains = consentDomains(linkerOpts)
+    consentPluginHelper.registerConsentPlugin(consentLinkHelper.consentLinker())
+    const domains = consentPluginHelper.consentDomains(linkerOpts)
 
     expect(domains).toContain('platform.test')
     expect(domains).toContain('site.test')
@@ -230,18 +224,18 @@ describe('consentDomains / decorateConsentUrl (registry level)', () => {
   })
 
   test('decorateConsentUrl applies the registered plugin to a plain URL', () => {
-    registerConsentPlugin(consentLinker())
+    consentPluginHelper.registerConsentPlugin(consentLinkHelper.consentLinker())
     const record: ConsentRecord = { [CONSENT_ESSENTIAL]: true, [CONSENT_ANALYTICS]: false, [CONSENT_MARKETING]: false }
-    const decorated = decorateConsentUrl('https://site.test/legal/cookies', record, linkerOpts)
+    const decorated = consentPluginHelper.decorateConsentUrl('https://site.test/legal/cookies', record, linkerOpts)
 
     expect(decorated.searchParams.has(CONSENT_LINK_PARAM)).toBe(true)
   })
 
   test('registering the same alias twice replaces rather than duplicates', () => {
-    registerConsentPlugin(consentLinker())
-    registerConsentPlugin(consentLinker())
+    consentPluginHelper.registerConsentPlugin(consentLinkHelper.consentLinker())
+    consentPluginHelper.registerConsentPlugin(consentLinkHelper.consentLinker())
     const record: ConsentRecord = { [CONSENT_ESSENTIAL]: true }
-    const decorated = decorateConsentUrl('https://site.test/', record, linkerOpts)
+    const decorated = consentPluginHelper.decorateConsentUrl('https://site.test/', record, linkerOpts)
 
     // A duplicate `decorate` implementation would still be idempotent (same value both times), so
     // what this actually guards is that the registry never grows unbounded per alias.
@@ -252,7 +246,7 @@ describe('consentDomains / decorateConsentUrl (registry level)', () => {
 describe('the store, with a linker configured', () => {
   test('adopts on init when nothing is stored yet, and applies it', () => {
     const record = { [CONSENT_ANALYTICS]: true, [CONSENT_MARKETING]: false }
-    env.goto(`https://platform.test/dispatcher?owlcc=${encodeConsentLink(record)}`, 'https://site.test/')
+    env.goto(`https://platform.test/dispatcher?owlcc=${consentLinkHelper.encodeConsentLink(record)}`, 'https://site.test/')
 
     const store = makeConsentStore()
     store.init({ silent: true, linker: { domains: DOMAINS } })
@@ -261,7 +255,7 @@ describe('the store, with a linker configured', () => {
     expect(store.get().record?.[CONSENT_ANALYTICS]).toBe(true)
     expect(store.granted(CONSENT_ESSENTIAL)).toBe(true)
     // Written through, not just held in memory — a second page load must see it too.
-    expect(readConsent()?.[CONSENT_ANALYTICS]).toBe(true)
+    expect(consentStorageHelper.readConsent()?.[CONSENT_ANALYTICS]).toBe(true)
   })
 
   test('strips the parameter from the URL either way', () => {
@@ -274,9 +268,9 @@ describe('the store, with a linker configured', () => {
   })
 
   test('never overwrites a decision this document already made', () => {
-    writeConsent({ [CONSENT_ANALYTICS]: false, [CONSENT_MARKETING]: false })
+    consentStorageHelper.writeConsent({ [CONSENT_ANALYTICS]: false, [CONSENT_MARKETING]: false })
     const incoming = { [CONSENT_ANALYTICS]: true, [CONSENT_MARKETING]: true }
-    env.goto(`https://platform.test/dispatcher?owlcc=${encodeConsentLink(incoming)}`, 'https://site.test/')
+    env.goto(`https://platform.test/dispatcher?owlcc=${consentLinkHelper.encodeConsentLink(incoming)}`, 'https://site.test/')
 
     const store = makeConsentStore()
     store.init({ silent: true, linker: { domains: DOMAINS } })
@@ -297,7 +291,7 @@ describe('the store, with a linker configured', () => {
 
 describe('consentBootstrapScript with a linker: order and shape', () => {
   test('the linker fragment sits after the default push and before the storage read', () => {
-    const script = consentBootstrapScript({ linker: { domains: DOMAINS } })
+    const script = consentModeHelper.consentBootstrapScript({ linker: { domains: DOMAINS } })
     const defaultAt = script.indexOf("'consent','default'")
     const linkerAt = script.indexOf('URLSearchParams')
     const storageAt = script.indexOf('w.localStorage.getItem')
@@ -308,11 +302,11 @@ describe('consentBootstrapScript with a linker: order and shape', () => {
   })
 
   test('emits nothing extra with no linker configured', () => {
-    expect(consentBootstrapScript()).not.toContain('URLSearchParams')
+    expect(consentModeHelper.consentBootstrapScript()).not.toContain('URLSearchParams')
   })
 
   test('escapes "<" inside embedded strings', () => {
-    const script = consentLinkerScript({ linker: { domains: ['<script>evil.test'] } })
+    const script = consentLinkHelper.consentLinkerScript({ linker: { domains: ['<script>evil.test'] } })
 
     expect(script).not.toContain('<script>evil.test')
     expect(script).toContain('\\u003cscript>evil.test')
@@ -322,31 +316,31 @@ describe('consentBootstrapScript with a linker: order and shape', () => {
 describe('consentLinkerScript, executed', () => {
   test('adopts a valid link and strips the parameter, via new Function', () => {
     const record = { [CONSENT_ANALYTICS]: true, [CONSENT_MARKETING]: false }
-    env.goto(`https://platform.test/dispatcher?owlcc=${encodeConsentLink(record)}`, 'https://site.test/')
+    env.goto(`https://platform.test/dispatcher?owlcc=${consentLinkHelper.encodeConsentLink(record)}`, 'https://site.test/')
 
-    const script = consentLinkerScript({ linker: { domains: DOMAINS } })
+    const script = consentLinkHelper.consentLinkerScript({ linker: { domains: DOMAINS } })
     // eslint-disable-next-line no-new-func
     new Function(script)()
 
     expect(env.href()).toBe('https://platform.test/dispatcher')
-    expect(readConsent()?.[CONSENT_ANALYTICS]).toBe(true)
+    expect(consentStorageHelper.readConsent()?.[CONSENT_ANALYTICS]).toBe(true)
   })
 
   test('never overwrites an existing record, and still strips', () => {
-    writeConsent({ [CONSENT_ANALYTICS]: false, [CONSENT_MARKETING]: false })
+    consentStorageHelper.writeConsent({ [CONSENT_ANALYTICS]: false, [CONSENT_MARKETING]: false })
     const incoming = { [CONSENT_ANALYTICS]: true, [CONSENT_MARKETING]: true }
-    env.goto(`https://platform.test/dispatcher?owlcc=${encodeConsentLink(incoming)}`, 'https://site.test/')
+    env.goto(`https://platform.test/dispatcher?owlcc=${consentLinkHelper.encodeConsentLink(incoming)}`, 'https://site.test/')
 
-    const script = consentLinkerScript({ linker: { domains: DOMAINS } })
+    const script = consentLinkHelper.consentLinkerScript({ linker: { domains: DOMAINS } })
     // eslint-disable-next-line no-new-func
     new Function(script)()
 
     expect(env.href()).toBe('https://platform.test/dispatcher')
-    expect(readConsent()?.[CONSENT_ANALYTICS]).toBe(false)
+    expect(consentStorageHelper.readConsent()?.[CONSENT_ANALYTICS]).toBe(false)
   })
 
   test('is an empty string with no linker configured', () => {
-    expect(consentLinkerScript({})).toBe('')
+    expect(consentLinkHelper.consentLinkerScript({})).toBe('')
   })
 })
 
@@ -370,7 +364,7 @@ describe('language: the link parameter', () => {
 
   test('carries the page language as `l`, lower-cased, when the sender turned it on', () => {
     env.lang('PL')
-    const decoded = decodeConsentLink(encodeConsentLink({ [CONSENT_ANALYTICS]: true }, withLanguage))
+    const decoded = consentLinkHelper.decodeConsentLink(consentLinkHelper.encodeConsentLink({ [CONSENT_ANALYTICS]: true }, withLanguage))
 
     expect(decoded?.l).toBe('pl')
     expect(decoded?.c).toEqual({ [CONSENT_ANALYTICS]: 1, [CONSENT_MARKETING]: 0 })
@@ -379,20 +373,20 @@ describe('language: the link parameter', () => {
   test('carries no `l` when the sender did not turn it on, whatever the page says', () => {
     env.lang('pl')
 
-    expect(decodeConsentLink(encodeConsentLink({ [CONSENT_ANALYTICS]: true }, linkerOpts))?.l).toBeUndefined()
+    expect(consentLinkHelper.decodeConsentLink(consentLinkHelper.encodeConsentLink({ [CONSENT_ANALYTICS]: true }, linkerOpts))?.l).toBeUndefined()
   })
 
   test('carries no `l` for a page with no usable language', () => {
     for (const lang of ['', 'not a language!', '12']) {
       env.lang(lang)
 
-      expect(decodeConsentLink(encodeConsentLink(null, withLanguage))?.l).toBeUndefined()
+      expect(consentLinkHelper.decodeConsentLink(consentLinkHelper.encodeConsentLink(null, withLanguage))?.l).toBeUndefined()
     }
   })
 
   test('encodes no decision at all as an empty `c`', () => {
     env.lang('de')
-    const decoded = decodeConsentLink(encodeConsentLink(null, withLanguage))
+    const decoded = consentLinkHelper.decodeConsentLink(consentLinkHelper.encodeConsentLink(null, withLanguage))
 
     expect(decoded?.c).toEqual({})
     expect(decoded?.l).toBe('de')
@@ -402,7 +396,7 @@ describe('language: the link parameter', () => {
     const raw = Buffer.from(JSON.stringify({
       v: 2, c: { [CONSENT_ANALYTICS]: 1 }, t: nowSeconds(), l: '../../etc',
     })).toString('base64url')
-    const decoded = decodeConsentLink(raw)
+    const decoded = consentLinkHelper.decodeConsentLink(raw)
 
     expect(decoded).not.toBeNull()
     expect(decoded?.l).toBeUndefined()
@@ -411,7 +405,7 @@ describe('language: the link parameter', () => {
 })
 
 describe('language: consentLinker().decorate', () => {
-  const plugin = consentLinker()
+  const plugin = consentLinkHelper.consentLinker()
   const withLanguage = { linker: { domains: DOMAINS, language: {} } }
   const record: ConsentRecord = { [CONSENT_ESSENTIAL]: true, [CONSENT_ANALYTICS]: true, [CONSENT_MARKETING]: false }
 
@@ -420,14 +414,14 @@ describe('language: consentLinker().decorate', () => {
     const decorated = plugin.decorate!(new URL('https://site.test/start'), null, withLanguage)
 
     expect(decorated).not.toBeNull()
-    const payload = decodeConsentLink(decorated!.searchParams.get(CONSENT_LINK_PARAM)!)
+    const payload = consentLinkHelper.decodeConsentLink(decorated!.searchParams.get(CONSENT_LINK_PARAM)!)
     expect(payload?.l).toBe('uk')
     expect(payload?.c).toEqual({})
   })
 
   test('carries the decision and the language together', () => {
     env.lang('pl')
-    const payload = decodeConsentLink(
+    const payload = consentLinkHelper.decodeConsentLink(
       plugin.decorate!(new URL('https://site.test/start'), record, withLanguage)!.searchParams.get(CONSENT_LINK_PARAM)!
     )
 
@@ -455,12 +449,12 @@ describe('language: consentLinker().decorate', () => {
 })
 
 describe('language: consentLinker().adoptLanguage', () => {
-  const plugin = consentLinker()
+  const plugin = consentLinkHelper.consentLinker()
   const receiving = { linker: { domains: DOMAINS, language: { supported: ['en', 'pl', 'de', 'fr'] } } }
   const carried = (lang: string, record: ConsentRecord | null = null): string => {
     env.lang(lang)
 
-    return encodeConsentLink(record, { linker: { domains: DOMAINS, language: {} } })
+    return consentLinkHelper.encodeConsentLink(record, { linker: { domains: DOMAINS, language: {} } })
   }
   const arrive = (owlcc: string, referrer = 'https://site.test/') => {
     env.goto(`https://platform.test/dispatcher?owlcc=${owlcc}`, referrer)
@@ -526,11 +520,11 @@ describe('language: consentLinker().adoptLanguage', () => {
   })
 
   test('registry: adoptConsentLanguage asks the registered plugin', () => {
-    registerConsentPlugin(consentLinker())
+    consentPluginHelper.registerConsentPlugin(consentLinkHelper.consentLinker())
     arrive(carried('pl'))
 
-    expect(adoptConsentLanguage(receiving)).toBe('pl')
-    expect(adoptConsentLanguage(linkerOpts)).toBeNull()
+    expect(consentPluginHelper.adoptConsentLanguage(receiving)).toBe('pl')
+    expect(consentPluginHelper.adoptConsentLanguage(linkerOpts)).toBeNull()
   })
 })
 
@@ -538,7 +532,7 @@ describe('language: strictly necessary, stored whatever the cookie decision is',
   const receiving = { silent: true, linker: { domains: DOMAINS, language: { supported: ['en', 'pl', 'de'] } } }
   const arrive = (lang: string, record: ConsentRecord | null = null, referrer = 'https://site.test/') => {
     env.lang(lang)
-    const owlcc = encodeConsentLink(record, { linker: { domains: DOMAINS, language: {} } })
+    const owlcc = consentLinkHelper.encodeConsentLink(record, { linker: { domains: DOMAINS, language: {} } })
     env.goto(`https://platform.test/dispatcher?owlcc=${owlcc}`, referrer)
     env.lang('en')
   }
@@ -551,9 +545,9 @@ describe('language: strictly necessary, stored whatever the cookie decision is',
     for (const record of [null, refused, accepted, withRetiredKey]) {
       env.reset()
       if (record != null) {
-        writeConsent(record)
+        consentStorageHelper.writeConsent(record)
       }
-      expect(writeConsentLanguage('pl', receiving)).toBe(true)
+      expect(consentLinkHelper.writeConsentLanguage('pl', receiving)).toBe(true)
       expect(env.store.get(CONSENT_LANGUAGE_KEY)).toBe('pl')
     }
   })
@@ -563,7 +557,7 @@ describe('language: strictly necessary, stored whatever the cookie decision is',
     const setItem = storage.setItem
     storage.setItem = () => { throw new Error('blocked') }
     try {
-      expect(writeConsentLanguage('pl', receiving)).toBe(false)
+      expect(consentLinkHelper.writeConsentLanguage('pl', receiving)).toBe(false)
     } finally {
       // The mock storage is shared by every test in the file.
       storage.setItem = setItem
@@ -607,7 +601,7 @@ describe('language: strictly necessary, stored whatever the cookie decision is',
     test('a stored decision of any kind lets the link\'s language through, and still wins over its decision', () => {
       for (const stored of [refused, accepted, withRetiredKey]) {
         env.reset()
-        writeConsent(stored)
+        consentStorageHelper.writeConsent(stored)
         arrive('pl', { [CONSENT_ANALYTICS]: !stored[CONSENT_ANALYTICS], [CONSENT_MARKETING]: true })
 
         const store = makeConsentStore()
@@ -669,9 +663,9 @@ describe('language: strictly necessary, stored whatever the cookie decision is',
   })
 
   describe('the inline fragment', () => {
-    const run = (opts: Parameters<typeof consentLinkerScript>[0] = receiving) => {
+    const run = (opts: Parameters<typeof consentLinkHelper.consentLinkerScript>[0] = receiving) => {
       // eslint-disable-next-line no-new-func
-      new Function(consentLinkerScript(opts))()
+      new Function(consentLinkHelper.consentLinkerScript(opts))()
     }
     const all = { linker: { domains: DOMAINS, language: { supported: ['en', 'pl', 'de', 'fr'] } } }
 
@@ -680,7 +674,7 @@ describe('language: strictly necessary, stored whatever the cookie decision is',
       run()
 
       expect(env.store.get(CONSENT_LANGUAGE_KEY)).toBe('pl')
-      expect(readConsent()).toBeNull()
+      expect(consentStorageHelper.readConsent()).toBeNull()
       expect(env.href()).toBe('https://platform.test/dispatcher')
     })
 
@@ -689,26 +683,26 @@ describe('language: strictly necessary, stored whatever the cookie decision is',
       run(all)
 
       expect(env.store.get(CONSENT_LANGUAGE_KEY)).toBe('fr')
-      expect(readConsent()?.[CONSENT_ANALYTICS]).toBe(true)
+      expect(consentStorageHelper.readConsent()?.[CONSENT_ANALYTICS]).toBe(true)
     })
 
     test('a link that carries "reject all" adopts the decision and stores the language', () => {
       arrive('fr', refused)
       run(all)
 
-      expect(readConsent()?.[CONSENT_ANALYTICS]).toBe(false)
+      expect(consentStorageHelper.readConsent()?.[CONSENT_ANALYTICS]).toBe(false)
       expect(env.store.get(CONSENT_LANGUAGE_KEY)).toBe('fr')
     })
 
     test('a stored record of any kind lets the language through, and the link\'s decision never overwrites it', () => {
       for (const stored of [refused, accepted, withRetiredKey]) {
         env.reset()
-        writeConsent(stored)
+        consentStorageHelper.writeConsent(stored)
         arrive('de', { [CONSENT_ANALYTICS]: !stored[CONSENT_ANALYTICS], [CONSENT_MARKETING]: true })
         run()
 
         expect(env.store.get(CONSENT_LANGUAGE_KEY)).toBe('de')
-        expect(readConsent()?.[CONSENT_ANALYTICS]).toBe(stored[CONSENT_ANALYTICS])
+        expect(consentStorageHelper.readConsent()?.[CONSENT_ANALYTICS]).toBe(stored[CONSENT_ANALYTICS])
       }
     })
 
@@ -755,14 +749,14 @@ describe('language: strictly necessary, stored whatever the cookie decision is',
     })
 
     test('a page that only sends carries no language code at all', () => {
-      const script = consentLinkerScript({ linker: { domains: DOMAINS, language: {} } })
+      const script = consentLinkHelper.consentLinkerScript({ linker: { domains: DOMAINS, language: {} } })
 
       expect(script).not.toContain(CONSENT_LANGUAGE_KEY)
-      expect(consentLinkerScript(linkerOpts)).toBe(script)
+      expect(consentLinkHelper.consentLinkerScript(linkerOpts)).toBe(script)
     })
 
     test('the bootstrap embeds it, after the defaults and before its own storage read', () => {
-      const script = consentBootstrapScript(receiving)
+      const script = consentModeHelper.consentBootstrapScript(receiving)
 
       expect(script.indexOf(CONSENT_LANGUAGE_KEY)).toBeGreaterThan(script.indexOf("'consent','default'"))
       // The fragment reads storage itself (to know whether a decision exists) before it writes the
@@ -771,7 +765,7 @@ describe('language: strictly necessary, stored whatever the cookie decision is',
     })
 
     test('escapes "<" in a configured language too', () => {
-      const script = consentLinkerScript({ linker: { domains: DOMAINS, language: { supported: ['<b>'], storageKey: '<k>' } } })
+      const script = consentLinkHelper.consentLinkerScript({ linker: { domains: DOMAINS, language: { supported: ['<b>'], storageKey: '<k>' } } })
 
       expect(script).not.toContain('<b>')
       expect(script).not.toContain('<k>')

package/tests/tracking.spec.ts

@@ -1,11 +1,11 @@
 import { describe, test, expect } from 'bun:test'
 import { CONSENT_ANALYTICS, CONSENT_ESSENTIAL, CONSENT_EVENT, CONSENT_KEY, CONSENT_MARKETING } from '../src/consts.js'
-import { consentGateScript, trackingGranted } from '../src/gtm.js'
+import { consentModeHelper } from '../src/gtobserver.js'
 import type { ConsentCategory, ConsentRecord } from '../src/types.js'
 
 describe('trackingGranted', () => {
   test('no record at all is not granted', () => {
-    expect(trackingGranted(null)).toBe(false)
+    expect(consentModeHelper.trackingGranted(null)).toBe(false)
   })
 
   test('an essential-only record is not granted — required categories never count', () => {
@@ -13,19 +13,19 @@ describe('trackingGranted', () => {
       [CONSENT_ESSENTIAL]: true, [CONSENT_ANALYTICS]: false, [CONSENT_MARKETING]: false,
     }
 
-    expect(trackingGranted(record)).toBe(false)
+    expect(consentModeHelper.trackingGranted(record)).toBe(false)
   })
 
   test('analytics granted is tracking-granted', () => {
     const record: ConsentRecord = { [CONSENT_ESSENTIAL]: true, [CONSENT_ANALYTICS]: true }
 
-    expect(trackingGranted(record)).toBe(true)
+    expect(consentModeHelper.trackingGranted(record)).toBe(true)
   })
 
   test('marketing granted is tracking-granted too', () => {
     const record: ConsentRecord = { [CONSENT_ESSENTIAL]: true, [CONSENT_MARKETING]: true }
 
-    expect(trackingGranted(record)).toBe(true)
+    expect(consentModeHelper.trackingGranted(record)).toBe(true)
   })
 
   test('a required category is ignored even when the record marks it granted', () => {
@@ -39,7 +39,7 @@ describe('trackingGranted', () => {
       },
     ]
 
-    expect(trackingGranted({ essential: true }, categories)).toBe(false)
+    expect(consentModeHelper.trackingGranted({ essential: true }, categories)).toBe(false)
   })
 
   test('a category with no signals is ignored even when granted', () => {
@@ -47,7 +47,7 @@ describe('trackingGranted', () => {
       { key: 'preferences', labelKey: 'a', descriptionKey: 'b' },
     ]
 
-    expect(trackingGranted({ preferences: true }, categories)).toBe(false)
+    expect(consentModeHelper.trackingGranted({ preferences: true }, categories)).toBe(false)
   })
 })
 
@@ -91,7 +91,7 @@ describe('consentGateScript — the two reachable paths', () => {
   test('a returning visitor with a stored grant runs the loader immediately, synchronously', () => {
     const browser = makeBrowser({ record: { essential: true, analytics: true, v: 2 } })
     browser.win.__loaded = 0
-    browser.run(consentGateScript('window.__loaded = (window.__loaded || 0) + 1'))
+    browser.run(consentModeHelper.consentGateScript('window.__loaded = (window.__loaded || 0) + 1'))
 
     expect(browser.win.__loaded).toBe(1)
     // Nothing left listening — the immediate branch never subscribes.
@@ -101,7 +101,7 @@ describe('consentGateScript — the two reachable paths', () => {
   test('a stored record that grants nothing does not run the loader immediately', () => {
     const browser = makeBrowser({ record: { essential: true, analytics: false, v: 2 } })
     browser.win.__loaded = 0
-    browser.run(consentGateScript('window.__loaded = (window.__loaded || 0) + 1'))
+    browser.run(consentModeHelper.consentGateScript('window.__loaded = (window.__loaded || 0) + 1'))
 
     expect(browser.win.__loaded).toBe(0)
     expect(browser.listenerCount()).toBe(1)
@@ -110,7 +110,7 @@ describe('consentGateScript — the two reachable paths', () => {
   test('no stored record at all falls to the event-listener branch and waits', () => {
     const browser = makeBrowser()
     browser.win.__loaded = 0
-    browser.run(consentGateScript('window.__loaded = (window.__loaded || 0) + 1'))
+    browser.run(consentModeHelper.consentGateScript('window.__loaded = (window.__loaded || 0) + 1'))
 
     expect(browser.win.__loaded).toBe(0)
 
@@ -145,7 +145,7 @@ describe('consentGateScript — the two reachable paths', () => {
     const doc = { cookie: `${CONSENT_KEY}=${record}` }
     // eslint-disable-next-line no-new-func
     new Function(
-      'window', 'document', consentGateScript('window.__loaded = (window.__loaded || 0) + 1')
+      'window', 'document', consentModeHelper.consentGateScript('window.__loaded = (window.__loaded || 0) + 1')
     )(win, doc)
 
     expect(win.__loaded).toBe(1)
@@ -158,7 +158,7 @@ describe('consentGateScript — the two reachable paths', () => {
     ]
     const browser = makeBrowser({ record: { essential: true, analytics: false, v: 2 } })
     browser.win.__loaded = 0
-    browser.run(consentGateScript('window.__loaded = (window.__loaded || 0) + 1', { categories }))
+    browser.run(consentModeHelper.consentGateScript('window.__loaded = (window.__loaded || 0) + 1', { categories }))
 
     expect(browser.win.__loaded).toBe(0)
 
@@ -167,7 +167,7 @@ describe('consentGateScript — the two reachable paths', () => {
   })
 
   test('the generated script carries both reachable code paths in its text', () => {
-    const script = consentGateScript('window.__loaded = (window.__loaded || 0) + 1')
+    const script = consentModeHelper.consentGateScript('window.__loaded = (window.__loaded || 0) + 1')
 
     // The immediate branch: `load()` called right after the stored-record check, before any
     // listener is attached.
@@ -182,7 +182,7 @@ describe('consentGateScript — the two reachable paths', () => {
   test('a custom storage key is honoured, matching the bootstrap script\'s own lookup', () => {
     const browser = makeBrowser({ key: 'custom_key', record: { essential: true, analytics: true, v: 2 } })
     browser.win.__loaded = 0
-    browser.run(consentGateScript(
+    browser.run(consentModeHelper.consentGateScript(
       'window.__loaded = (window.__loaded || 0) + 1', { storageKey: 'custom_key' }
     ))
 

package/build/gtm.d.ts

@@ -1,72 +0,0 @@
-import type { ConsentCategory, ConsentOptions, ConsentRecord } from './types.js';
-/**
- * Push onto the tag-manager queue in the shape Google's own snippet uses.
- *
- * `arguments`, not an array literal. Both work with today's Consent API, but `arguments` is what
- * `gtag.js` itself emits, and a page that carries both this and Google's snippet should not have
- * two shapes in one queue.
- */
-export declare function gtagConsent(..._args: unknown[]): void;
-/** Every signal the configured categories drive, at its pre-consent value. */
-export declare const consentDefaults: (categories?: ConsentCategory[]) => Record<string, 'granted' | 'denied'>;
-/** Every signal, at the value this record implies. */
-export declare const consentUpdate: (record: ConsentRecord, categories?: ConsentCategory[]) => Record<string, 'granted' | 'denied'>;
-/**
- * Declare what is denied, before any tag can act.
- *
- * Idempotent through a window flag, because the page may carry this call twice — once inline in
- * the document head, once from whatever bundle mounts the dialog — and a second `default` after a
- * tag has loaded is worse than none: it can widen what was already narrowed.
- */
-export declare const pushConsentDefaults: (opts?: ConsentOptions) => void;
-/**
- * Apply a decision: globals first, then the signal update, then any per-category events.
- *
- * The order is load-bearing. A tag that fires on the update event reads the globals in the same
- * turn, so writing them afterwards would let the first firing see the previous answer.
- */
-export declare const applyConsent: (record: ConsentRecord, opts?: ConsentOptions) => void;
-/**
- * Whether a stored decision grants tracking at all — a signal-bearing category, not merely the
- * required essential one.
- *
- * "Signal-bearing" is what a required category can never be: it exists to gate whether a LOADER
- * runs, and a required category is disclosure, not a question — everyone gets it. Only a category
- * that both is optional and drives at least one Consent Mode signal counts, which is exactly what
- * `googleTagHeadScript`'s `'basic'` mode gates a Google tag behind.
- */
-export declare const trackingGranted: (record: ConsentRecord | null, categories?: ConsentCategory[]) => boolean;
-/**
- * The inline script a document stamps ABOVE its tag-manager snippet.
- *
- * It exists because the defaults have to be on the queue before `gtm.js` loads, and a React bundle
- * cannot be: by the time an island mounts, the container has been running for hundreds of
- * milliseconds and has already decided what it may do. Emitting it from the HTML is the only
- * ordering that holds — and it reads the stored record too, so a returning visitor's tags are not
- * denied for the first paint of every page.
- */
-export declare const consentBootstrapScript: (opts?: ConsentOptions) => string;
-/**
- * Withhold a loader until a stored or later decision grants tracking.
- *
- * The counterpart to `consentBootstrapScript` for the `'basic'` gated loading mode
- * (`@owlmeans/web-gtm`'s `GOOGLE_TAG_DEFAULT_MODE`): where the bootstrap always declares Consent
- * Mode's defaults so a tag may load cookieless, this withholds the tag itself — the loader string
- * is only ever reached once `trackingGranted` is true, either because a returning visitor's stored
- * record already says so, or because `applyConsent` later dispatches {@link CONSENT_EVENT} with
- * one that does. The listener removes itself on the first passing event, so the loader — which
- * marks its own element and refuses to run twice — is asked to run at most once from here.
- *
- * `loaderExpr` is a complete statement or expression that runs the loader when reached — the
- * self-invoking IIFE string `googleTagHeadScript`'s `gtagScript`/`gtmContainerScript` already
- * produce, embedded here verbatim rather than called. It is placed inline exactly as
- * `consentBootstrapScript`'s own output is: dynamic values (the storage key, the category shape,
- * the event name) are JSON-encoded so nothing configured can break out of a string literal, and
- * escaping the RESULT for HTML (`</script`, `<!--`) is left to whoever composes the final inline
- * script — the same discipline `consentBootstrapScript` follows, and `googleTagHeadScript` already
- * applies to the whole script it stamps.
- */
-export declare const consentGateScript: (loaderExpr: string, opts?: ConsentOptions & {
-    categories?: ConsentCategory[];
-}) => string;
-//# sourceMappingURL=gtm.d.ts.map

package/build/gtm.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"gtm.d.ts","sourceRoot":"","sources":["../src/gtm.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAUhF;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,GAAG,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,CAUrD;AAKD,8EAA8E;AAC9E,eAAO,MAAM,eAAe,gBACb,eAAe,EAAE,KAC7B,MAAM,CAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,CAMrC,CAAA;AAED,sDAAsD;AACtD,eAAO,MAAM,aAAa,WAChB,aAAa,eAAe,eAAe,EAAE,KACpD,MAAM,CAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,CAWrC,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,UAAW,cAAc,KAAG,IAO3D,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,YAAY,WAAY,aAAa,SAAS,cAAc,KAAG,IA6B3E,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,WAClB,aAAa,GAAG,IAAI,eAAc,eAAe,EAAE,KAC1D,OAEF,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,UAAW,cAAc,KAAG,MA+B9D,CAAA;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,iBAAiB,eAChB,MAAM,SAAS,cAAc,GAAG;IAAE,UAAU,CAAC,EAAE,eAAe,EAAE,CAAA;CAAE,KAC7E,MAuBF,CAAA"}