@owlmeans/consent 0.1.18-rc.9 → 0.1.18

package/build/gtm.js

@@ -1,182 +0,0 @@
-import { CONSENT_EVENT, CONSENT_KEY, CONSENT_SETUP_FLAG, CONSENT_SIGNAL_DEFAULTS, DEFAULT_CONSENT_CATEGORIES, } from './consts.js';
-import { consentLinkerScript } from './linker.js';
-const global = () => typeof window !== 'undefined' ? window : null;
-/**
- * Push onto the tag-manager queue in the shape Google's own snippet uses.
- *
- * `arguments`, not an array literal. Both work with today's Consent API, but `arguments` is what
- * `gtag.js` itself emits, and a page that carries both this and Google's snippet should not have
- * two shapes in one queue.
- */
-export function gtagConsent(..._args) {
-    const win = global();
-    if (win == null) {
-        return;
-    }
-    win.dataLayer = win.dataLayer ?? [];
-    // `arguments`, not `_args`. The rest parameter is only here to type the call sites; what goes on
-    // the queue must be the arguments object itself.
-    // eslint-disable-next-line prefer-rest-params
-    win.dataLayer.push(arguments);
-}
-const categoriesOf = (opts) => opts?.categories ?? DEFAULT_CONSENT_CATEGORIES;
-/** Every signal the configured categories drive, at its pre-consent value. */
-export const consentDefaults = (categories) => {
-    const used = new Set((categories ?? DEFAULT_CONSENT_CATEGORIES)
-        .flatMap(category => category.signals ?? []));
-    return Object.fromEntries(Object.entries(CONSENT_SIGNAL_DEFAULTS)
-        .filter(([signal]) => used.has(signal)));
-};
-/** Every signal, at the value this record implies. */
-export const consentUpdate = (record, categories) => {
-    const update = {};
-    for (const category of categories ?? DEFAULT_CONSENT_CATEGORIES) {
-        const granted = category.required === true || record[category.key] === true;
-        for (const signal of category.signals ?? []) {
-            // A signal named by two categories is granted only when every one of them is.
-            update[signal] = granted && update[signal] !== 'denied' ? 'granted' : 'denied';
-        }
-    }
-    return update;
-};
-/**
- * Declare what is denied, before any tag can act.
- *
- * Idempotent through a window flag, because the page may carry this call twice — once inline in
- * the document head, once from whatever bundle mounts the dialog — and a second `default` after a
- * tag has loaded is worse than none: it can widen what was already narrowed.
- */
-export const pushConsentDefaults = (opts) => {
-    const win = global();
-    if (win == null || opts?.silent === true || win[CONSENT_SETUP_FLAG] === true) {
-        return;
-    }
-    gtagConsent('consent', 'default', consentDefaults(categoriesOf(opts)));
-    win[CONSENT_SETUP_FLAG] = true;
-};
-/**
- * Apply a decision: globals first, then the signal update, then any per-category events.
- *
- * The order is load-bearing. A tag that fires on the update event reads the globals in the same
- * turn, so writing them afterwards would let the first firing see the previous answer.
- */
-export const applyConsent = (record, opts) => {
-    const win = global();
-    if (win == null || opts?.silent === true) {
-        return;
-    }
-    const categories = categoriesOf(opts);
-    for (const category of categories) {
-        if (category.globalVar != null) {
-            win[category.globalVar] = category.required === true || record[category.key] === true;
-        }
-    }
-    gtagConsent('consent', 'update', consentUpdate(record, categories));
-    for (const category of categories) {
-        if (category.event != null && (category.required === true || record[category.key] === true)) {
-            win.dataLayer = win.dataLayer ?? [];
-            win.dataLayer.push({ event: category.event });
-        }
-    }
-    // A gate script (`consentGateScript`) that already decided NOT to load, because nothing was
-    // granted at the time it ran, has no other way to hear this. Consent Mode itself speaks only on
-    // `dataLayer`, which a tag that never loaded is not listening to.
-    if (typeof window !== 'undefined' && typeof window.dispatchEvent === 'function'
-        && typeof CustomEvent === 'function') {
-        window.dispatchEvent(new CustomEvent(CONSENT_EVENT, { detail: { record } }));
-    }
-};
-/**
- * Whether a stored decision grants tracking at all — a signal-bearing category, not merely the
- * required essential one.
- *
- * "Signal-bearing" is what a required category can never be: it exists to gate whether a LOADER
- * runs, and a required category is disclosure, not a question — everyone gets it. Only a category
- * that both is optional and drives at least one Consent Mode signal counts, which is exactly what
- * `googleTagHeadScript`'s `'basic'` mode gates a Google tag behind.
- */
-export const trackingGranted = (record, categories = DEFAULT_CONSENT_CATEGORIES) => record != null && categories.some(category => !category.required && (category.signals?.length ?? 0) > 0 && record[category.key] === true);
-/**
- * The inline script a document stamps ABOVE its tag-manager snippet.
- *
- * It exists because the defaults have to be on the queue before `gtm.js` loads, and a React bundle
- * cannot be: by the time an island mounts, the container has been running for hundreds of
- * milliseconds and has already decided what it may do. Emitting it from the HTML is the only
- * ordering that holds — and it reads the stored record too, so a returning visitor's tags are not
- * denied for the first paint of every page.
- */
-export const consentBootstrapScript = (opts) => {
-    const defaults = JSON.stringify(consentDefaults(categoriesOf(opts)));
-    const categories = JSON.stringify(categoriesOf(opts).map(category => ({
-        key: category.key,
-        required: category.required === true,
-        signals: category.signals ?? [],
-        globalVar: category.globalVar ?? null,
-    })));
-    const storageKey = JSON.stringify(opts?.storageKey ?? CONSENT_KEY);
-    const flag = JSON.stringify(CONSENT_SETUP_FLAG);
-    // Right after the default is pushed and before EITHER storage read below (this one, and the
-    // `consentGateScript` that is concatenated after this whole IIFE) — an adopted decision must
-    // already be in storage by the time anything reads it, so `gtm.js`'s own `page_view` never sees
-    // the parameter and a granted decision loads the tag on arrival. A page with no `opts.linker`
-    // gets an empty string here, unchanged from before this existed.
-    const linker = opts?.linker != null ? `${consentLinkerScript(opts)};` : '';
-    return `(function(w,d){` +
-        `w.dataLayer=w.dataLayer||[];function g(){w.dataLayer.push(arguments)}` +
-        `if(w[${flag}])return;g('consent','default',${defaults});w[${flag}]=true;` +
-        linker +
-        `var raw=null;try{raw=w.localStorage.getItem(${storageKey})}catch(e){}` +
-        `if(!raw){var p=('; '+d.cookie).split('; '+${storageKey}+'=');` +
-        `if(p.length===2){raw=p.pop().split(';').shift()}}` +
-        `if(!raw)return;var r;try{r=JSON.parse(raw)}catch(e){return}` +
-        `var cs=${categories},u={};` +
-        `for(var i=0;i<cs.length;i++){var c=cs[i];var ok=c.required||r[c.key]===true;` +
-        `if(c.globalVar){w[c.globalVar]=ok}` +
-        `for(var j=0;j<c.signals.length;j++){var s=c.signals[j];` +
-        `u[s]=ok&&u[s]!=='denied'?'granted':'denied'}}` +
-        `g('consent','update',u)})(window,document)`;
-};
-/**
- * Withhold a loader until a stored or later decision grants tracking.
- *
- * The counterpart to `consentBootstrapScript` for the `'basic'` gated loading mode
- * (`@owlmeans/web-gtm`'s `GOOGLE_TAG_DEFAULT_MODE`): where the bootstrap always declares Consent
- * Mode's defaults so a tag may load cookieless, this withholds the tag itself — the loader string
- * is only ever reached once `trackingGranted` is true, either because a returning visitor's stored
- * record already says so, or because `applyConsent` later dispatches {@link CONSENT_EVENT} with
- * one that does. The listener removes itself on the first passing event, so the loader — which
- * marks its own element and refuses to run twice — is asked to run at most once from here.
- *
- * `loaderExpr` is a complete statement or expression that runs the loader when reached — the
- * self-invoking IIFE string `googleTagHeadScript`'s `gtagScript`/`gtmContainerScript` already
- * produce, embedded here verbatim rather than called. It is placed inline exactly as
- * `consentBootstrapScript`'s own output is: dynamic values (the storage key, the category shape,
- * the event name) are JSON-encoded so nothing configured can break out of a string literal, and
- * escaping the RESULT for HTML (`</script`, `<!--`) is left to whoever composes the final inline
- * script — the same discipline `consentBootstrapScript` follows, and `googleTagHeadScript` already
- * applies to the whole script it stamps.
- */
-export const consentGateScript = (loaderExpr, opts) => {
-    const gate = JSON.stringify(categoriesOf(opts).map(category => ({
-        key: category.key,
-        required: category.required === true,
-        hasSignal: (category.signals ?? []).length > 0,
-    })));
-    const storageKey = JSON.stringify(opts?.storageKey ?? CONSENT_KEY);
-    const event = JSON.stringify(CONSENT_EVENT);
-    return `(function(w,d){` +
-        `function ok(r){if(!r)return false;var cs=${gate};` +
-        `for(var i=0;i<cs.length;i++){var c=cs[i];` +
-        `if(!c.required&&c.hasSignal&&r[c.key]===true)return true}return false}` +
-        `function load(){${loaderExpr}}` +
-        `var raw=null;try{raw=w.localStorage.getItem(${storageKey})}catch(e){}` +
-        `if(!raw){var p=('; '+d.cookie).split('; '+${storageKey}+'=');` +
-        `if(p.length===2){raw=p.pop().split(';').shift()}}` +
-        `var r=null;if(raw){try{r=JSON.parse(raw)}catch(e){r=null}}` +
-        `if(ok(r)){load();return}` +
-        `function h(ev){if(ok(ev&&ev.detail&&ev.detail.record)){` +
-        `w.removeEventListener(${event},h);load()}}` +
-        `w.addEventListener(${event},h)` +
-        `})(window,document)`;
-};
-//# sourceMappingURL=gtm.js.map

package/build/gtm.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"gtm.js","sourceRoot":"","sources":["../src/gtm.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EAAE,WAAW,EAAE,kBAAkB,EAAE,uBAAuB,EACvE,0BAA0B,GAC3B,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAQjD,MAAM,MAAM,GAAG,GAAyB,EAAE,CACxC,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAkC,CAAC,CAAC,CAAC,IAAI,CAAA;AAE3E;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,GAAG,KAAgB;IAC7C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;IACpB,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAChB,OAAM;IACR,CAAC;IACD,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,EAAE,CAAA;IACnC,iGAAiG;IACjG,iDAAiD;IACjD,8CAA8C;IAC9C,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AAC/B,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,IAAqB,EAAqB,EAAE,CAChE,IAAI,EAAE,UAAU,IAAI,0BAA0B,CAAA;AAEhD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,UAA8B,EACQ,EAAE;IACxC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,IAAI,0BAA0B,CAAC;SAC5D,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAA;IAE/C,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC;SAC9D,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAe,CAAC,CAAC,CAAC,CAAA;AACrD,CAAC,CAAA;AAED,sDAAsD;AACtD,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,MAAqB,EAAE,UAA8B,EACf,EAAE;IACxC,MAAM,MAAM,GAAyC,EAAE,CAAA;IACvD,KAAK,MAAM,QAAQ,IAAI,UAAU,IAAI,0BAA0B,EAAE,CAAC;QAChE,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,IAAI,CAAA;QAC3E,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YAC5C,8EAA8E;YAC9E,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAA;QAChF,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,IAAqB,EAAQ,EAAE;IACjE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;IACpB,IAAI,GAAG,IAAI,IAAI,IAAI,IAAI,EAAE,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,kBAAkB,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7E,OAAM;IACR,CAAC;IACD,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACtE,GAAG,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAA;AAChC,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAqB,EAAE,IAAqB,EAAQ,EAAE;IACjF,MAAM,GAAG,GAAG,MAAM,EAAE,CAAA;IACpB,IAAI,GAAG,IAAI,IAAI,IAAI,IAAI,EAAE,MAAM,KAAK,IAAI,EAAE,CAAC;QACzC,OAAM;IACR,CAAC;IACD,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IAErC,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,IAAI,QAAQ,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;YAC/B,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,QAAQ,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,IAAI,CAAA;QACvF,CAAC;IACH,CAAC;IAED,WAAW,CAAC,SAAS,EAAE,QAAQ,EAAE,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAA;IAEnE,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,IAAI,QAAQ,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YAC5F,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,EAAE,CAAA;YACnC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;QAC/C,CAAC;IACH,CAAC;IAED,4FAA4F;IAC5F,gGAAgG;IAChG,kEAAkE;IAClE,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,UAAU;WAC1E,OAAO,WAAW,KAAK,UAAU,EAAE,CAAC;QACvC,MAAM,CAAC,aAAa,CAAC,IAAI,WAAW,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAA;IAC9E,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,MAA4B,EAAE,UAAU,GAAsB,0BAA0B,EAC/E,EAAE,CAAC,MAAM,IAAI,IAAI,IAAI,UAAU,CAAC,IAAI,CAC7C,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,IAAI,CACvG,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,IAAqB,EAAU,EAAE;IACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACpE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACpE,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,KAAK,IAAI;QACpC,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,EAAE;QAC/B,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,IAAI;KACtC,CAAC,CAAC,CAAC,CAAA;IACJ,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,IAAI,WAAW,CAAC,CAAA;IAClE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAA;IAC/C,4FAA4F;IAC5F,6FAA6F;IAC7F,gGAAgG;IAChG,8FAA8F;IAC9F,iEAAiE;IACjE,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;IAE1E,OAAO,iBAAiB;QACtB,uEAAuE;QACvE,QAAQ,IAAI,kCAAkC,QAAQ,OAAO,IAAI,SAAS;QAC1E,MAAM;QACN,+CAA+C,UAAU,cAAc;QACvE,6CAA6C,UAAU,QAAQ;QAC/D,mDAAmD;QACnD,6DAA6D;QAC7D,UAAU,UAAU,QAAQ;QAC5B,8EAA8E;QAC9E,oCAAoC;QACpC,yDAAyD;QACzD,+CAA+C;QAC/C,4CAA4C,CAAA;AAChD,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,UAAkB,EAAE,IAA0D,EACtE,EAAE;IACV,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC9D,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,KAAK,IAAI;QACpC,SAAS,EAAE,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;KAC/C,CAAC,CAAC,CAAC,CAAA;IACJ,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,IAAI,WAAW,CAAC,CAAA;IAClE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;IAE3C,OAAO,iBAAiB;QACtB,4CAA4C,IAAI,GAAG;QACnD,2CAA2C;QAC3C,wEAAwE;QACxE,mBAAmB,UAAU,GAAG;QAChC,+CAA+C,UAAU,cAAc;QACvE,6CAA6C,UAAU,QAAQ;QAC/D,mDAAmD;QACnD,4DAA4D;QAC5D,0BAA0B;QAC1B,yDAAyD;QACzD,yBAAyB,KAAK,cAAc;QAC5C,sBAAsB,KAAK,KAAK;QAChC,qBAAqB,CAAA;AACzB,CAAC,CAAA"}

package/src/gtm.ts

@@ -1,220 +0,0 @@
-import {
-  CONSENT_EVENT, CONSENT_KEY, CONSENT_SETUP_FLAG, CONSENT_SIGNAL_DEFAULTS,
-  DEFAULT_CONSENT_CATEGORIES,
-} from './consts.js'
-import { consentLinkerScript } from './linker.js'
-import type { ConsentCategory, ConsentOptions, ConsentRecord } from './types.js'
-
-interface ConsentWindow {
-  dataLayer?: unknown[]
-  [flag: string]: unknown
-}
-
-const global = (): ConsentWindow | null =>
-  typeof window !== 'undefined' ? window as unknown as ConsentWindow : null
-
-/**
- * Push onto the tag-manager queue in the shape Google's own snippet uses.
- *
- * `arguments`, not an array literal. Both work with today's Consent API, but `arguments` is what
- * `gtag.js` itself emits, and a page that carries both this and Google's snippet should not have
- * two shapes in one queue.
- */
-export function gtagConsent(..._args: unknown[]): void {
-  const win = global()
-  if (win == null) {
-    return
-  }
-  win.dataLayer = win.dataLayer ?? []
-  // `arguments`, not `_args`. The rest parameter is only here to type the call sites; what goes on
-  // the queue must be the arguments object itself.
-  // eslint-disable-next-line prefer-rest-params
-  win.dataLayer.push(arguments)
-}
-
-const categoriesOf = (opts?: ConsentOptions): ConsentCategory[] =>
-  opts?.categories ?? DEFAULT_CONSENT_CATEGORIES
-
-/** Every signal the configured categories drive, at its pre-consent value. */
-export const consentDefaults = (
-  categories?: ConsentCategory[]
-): Record<string, 'granted' | 'denied'> => {
-  const used = new Set((categories ?? DEFAULT_CONSENT_CATEGORIES)
-    .flatMap(category => category.signals ?? []))
-
-  return Object.fromEntries(Object.entries(CONSENT_SIGNAL_DEFAULTS)
-    .filter(([signal]) => used.has(signal as never)))
-}
-
-/** Every signal, at the value this record implies. */
-export const consentUpdate = (
-  record: ConsentRecord, categories?: ConsentCategory[]
-): Record<string, 'granted' | 'denied'> => {
-  const update: Record<string, 'granted' | 'denied'> = {}
-  for (const category of categories ?? DEFAULT_CONSENT_CATEGORIES) {
-    const granted = category.required === true || record[category.key] === true
-    for (const signal of category.signals ?? []) {
-      // A signal named by two categories is granted only when every one of them is.
-      update[signal] = granted && update[signal] !== 'denied' ? 'granted' : 'denied'
-    }
-  }
-
-  return update
-}
-
-/**
- * Declare what is denied, before any tag can act.
- *
- * Idempotent through a window flag, because the page may carry this call twice — once inline in
- * the document head, once from whatever bundle mounts the dialog — and a second `default` after a
- * tag has loaded is worse than none: it can widen what was already narrowed.
- */
-export const pushConsentDefaults = (opts?: ConsentOptions): void => {
-  const win = global()
-  if (win == null || opts?.silent === true || win[CONSENT_SETUP_FLAG] === true) {
-    return
-  }
-  gtagConsent('consent', 'default', consentDefaults(categoriesOf(opts)))
-  win[CONSENT_SETUP_FLAG] = true
-}
-
-/**
- * Apply a decision: globals first, then the signal update, then any per-category events.
- *
- * The order is load-bearing. A tag that fires on the update event reads the globals in the same
- * turn, so writing them afterwards would let the first firing see the previous answer.
- */
-export const applyConsent = (record: ConsentRecord, opts?: ConsentOptions): void => {
-  const win = global()
-  if (win == null || opts?.silent === true) {
-    return
-  }
-  const categories = categoriesOf(opts)
-
-  for (const category of categories) {
-    if (category.globalVar != null) {
-      win[category.globalVar] = category.required === true || record[category.key] === true
-    }
-  }
-
-  gtagConsent('consent', 'update', consentUpdate(record, categories))
-
-  for (const category of categories) {
-    if (category.event != null && (category.required === true || record[category.key] === true)) {
-      win.dataLayer = win.dataLayer ?? []
-      win.dataLayer.push({ event: category.event })
-    }
-  }
-
-  // A gate script (`consentGateScript`) that already decided NOT to load, because nothing was
-  // granted at the time it ran, has no other way to hear this. Consent Mode itself speaks only on
-  // `dataLayer`, which a tag that never loaded is not listening to.
-  if (typeof window !== 'undefined' && typeof window.dispatchEvent === 'function'
-    && typeof CustomEvent === 'function') {
-    window.dispatchEvent(new CustomEvent(CONSENT_EVENT, { detail: { record } }))
-  }
-}
-
-/**
- * Whether a stored decision grants tracking at all — a signal-bearing category, not merely the
- * required essential one.
- *
- * "Signal-bearing" is what a required category can never be: it exists to gate whether a LOADER
- * runs, and a required category is disclosure, not a question — everyone gets it. Only a category
- * that both is optional and drives at least one Consent Mode signal counts, which is exactly what
- * `googleTagHeadScript`'s `'basic'` mode gates a Google tag behind.
- */
-export const trackingGranted = (
-  record: ConsentRecord | null, categories: ConsentCategory[] = DEFAULT_CONSENT_CATEGORIES
-): boolean => record != null && categories.some(
-  category => !category.required && (category.signals?.length ?? 0) > 0 && record[category.key] === true
-)
-
-/**
- * The inline script a document stamps ABOVE its tag-manager snippet.
- *
- * It exists because the defaults have to be on the queue before `gtm.js` loads, and a React bundle
- * cannot be: by the time an island mounts, the container has been running for hundreds of
- * milliseconds and has already decided what it may do. Emitting it from the HTML is the only
- * ordering that holds — and it reads the stored record too, so a returning visitor's tags are not
- * denied for the first paint of every page.
- */
-export const consentBootstrapScript = (opts?: ConsentOptions): string => {
-  const defaults = JSON.stringify(consentDefaults(categoriesOf(opts)))
-  const categories = JSON.stringify(categoriesOf(opts).map(category => ({
-    key: category.key,
-    required: category.required === true,
-    signals: category.signals ?? [],
-    globalVar: category.globalVar ?? null,
-  })))
-  const storageKey = JSON.stringify(opts?.storageKey ?? CONSENT_KEY)
-  const flag = JSON.stringify(CONSENT_SETUP_FLAG)
-  // Right after the default is pushed and before EITHER storage read below (this one, and the
-  // `consentGateScript` that is concatenated after this whole IIFE) — an adopted decision must
-  // already be in storage by the time anything reads it, so `gtm.js`'s own `page_view` never sees
-  // the parameter and a granted decision loads the tag on arrival. A page with no `opts.linker`
-  // gets an empty string here, unchanged from before this existed.
-  const linker = opts?.linker != null ? `${consentLinkerScript(opts)};` : ''
-
-  return `(function(w,d){` +
-    `w.dataLayer=w.dataLayer||[];function g(){w.dataLayer.push(arguments)}` +
-    `if(w[${flag}])return;g('consent','default',${defaults});w[${flag}]=true;` +
-    linker +
-    `var raw=null;try{raw=w.localStorage.getItem(${storageKey})}catch(e){}` +
-    `if(!raw){var p=('; '+d.cookie).split('; '+${storageKey}+'=');` +
-    `if(p.length===2){raw=p.pop().split(';').shift()}}` +
-    `if(!raw)return;var r;try{r=JSON.parse(raw)}catch(e){return}` +
-    `var cs=${categories},u={};` +
-    `for(var i=0;i<cs.length;i++){var c=cs[i];var ok=c.required||r[c.key]===true;` +
-    `if(c.globalVar){w[c.globalVar]=ok}` +
-    `for(var j=0;j<c.signals.length;j++){var s=c.signals[j];` +
-    `u[s]=ok&&u[s]!=='denied'?'granted':'denied'}}` +
-    `g('consent','update',u)})(window,document)`
-}
-
-/**
- * Withhold a loader until a stored or later decision grants tracking.
- *
- * The counterpart to `consentBootstrapScript` for the `'basic'` gated loading mode
- * (`@owlmeans/web-gtm`'s `GOOGLE_TAG_DEFAULT_MODE`): where the bootstrap always declares Consent
- * Mode's defaults so a tag may load cookieless, this withholds the tag itself — the loader string
- * is only ever reached once `trackingGranted` is true, either because a returning visitor's stored
- * record already says so, or because `applyConsent` later dispatches {@link CONSENT_EVENT} with
- * one that does. The listener removes itself on the first passing event, so the loader — which
- * marks its own element and refuses to run twice — is asked to run at most once from here.
- *
- * `loaderExpr` is a complete statement or expression that runs the loader when reached — the
- * self-invoking IIFE string `googleTagHeadScript`'s `gtagScript`/`gtmContainerScript` already
- * produce, embedded here verbatim rather than called. It is placed inline exactly as
- * `consentBootstrapScript`'s own output is: dynamic values (the storage key, the category shape,
- * the event name) are JSON-encoded so nothing configured can break out of a string literal, and
- * escaping the RESULT for HTML (`</script`, `<!--`) is left to whoever composes the final inline
- * script — the same discipline `consentBootstrapScript` follows, and `googleTagHeadScript` already
- * applies to the whole script it stamps.
- */
-export const consentGateScript = (
-  loaderExpr: string, opts?: ConsentOptions & { categories?: ConsentCategory[] }
-): string => {
-  const gate = JSON.stringify(categoriesOf(opts).map(category => ({
-    key: category.key,
-    required: category.required === true,
-    hasSignal: (category.signals ?? []).length > 0,
-  })))
-  const storageKey = JSON.stringify(opts?.storageKey ?? CONSENT_KEY)
-  const event = JSON.stringify(CONSENT_EVENT)
-
-  return `(function(w,d){` +
-    `function ok(r){if(!r)return false;var cs=${gate};` +
-    `for(var i=0;i<cs.length;i++){var c=cs[i];` +
-    `if(!c.required&&c.hasSignal&&r[c.key]===true)return true}return false}` +
-    `function load(){${loaderExpr}}` +
-    `var raw=null;try{raw=w.localStorage.getItem(${storageKey})}catch(e){}` +
-    `if(!raw){var p=('; '+d.cookie).split('; '+${storageKey}+'=');` +
-    `if(p.length===2){raw=p.pop().split(';').shift()}}` +
-    `var r=null;if(raw){try{r=JSON.parse(raw)}catch(e){r=null}}` +
-    `if(ok(r)){load();return}` +
-    `function h(ev){if(ok(ev&&ev.detail&&ev.detail.record)){` +
-    `w.removeEventListener(${event},h);load()}}` +
-    `w.addEventListener(${event},h)` +
-    `})(window,document)`
-}