@owlmeans/marketing-consent 0.1.18-rc.0

package/README.md

@@ -0,0 +1,15 @@
+<!-- owlmeans:agent-guidance:start -->
+## Agent guidance
+
+This package ships embedded agent skills under `agent-meta/`. After installing your
+`@owlmeans/*` packages, run the OwlMeans agent-skills installer to place them into
+your project's skill store (`.agents/skills/`):
+
+```sh
+npx @owlmeans/agent-skills@^0.1.18-rc.33
+```
+
+The embedded files are version-matched to this package release. Do not edit them
+directly — they are regenerated on each publish. To contribute guidance edits,
+open a PR against the source monorepo.
+<!-- owlmeans:agent-guidance:end -->

package/agent-meta/manifest.json

@@ -0,0 +1,16 @@
+{
+  "schemaVersion": 2,
+  "package": "@owlmeans/marketing-consent",
+  "version": "0.1.18-rc.0",
+  "generatedAt": "2026-09-22T17:37:10.924Z",
+  "canonicalRepo": "https://github.com/owlmeans/common",
+  "entries": [
+    {
+      "kind": "skill",
+      "name": "marketing-consent",
+      "category": "package-specific",
+      "file": "skills/marketing-consent/SKILL.md",
+      "canonicalPath": ".agents/skills/marketing-consent/SKILL.md"
+    }
+  ]
+}

package/agent-meta/skills/marketing-consent/SKILL.md

@@ -0,0 +1,169 @@
+---
+name: marketing-consent
+description: How to use @owlmeans/marketing-consent — the standard 8-key marketing/data/tracker consent catalogue, revision-aware status resolution (new/revised/current, GPC honoring), terms acceptance, and the guarded consent-surface protocol tree (makeMarketingConsentProtocols). Auto-invoked when importing marketing-consent constants/types/schemas, resolving or displaying a person's consent status, saving consent decisions, or reasoning about which legal basis a marketing/tracking consent needs.
+user-invocable: false
+---
+<!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
+
+# @owlmeans/marketing-consent
+
+**Layer:** Domain (beside `consent`, `payment`, `planning`)
+**Install:** `"@owlmeans/marketing-consent": "^0.1.18-rc.0"` in `dependencies`
+**Sibling:** `@owlmeans/consent` — the cookie-consent widget. This package's two `trackers.*` keys
+carry a `cookieCategory` pointing at that package's `CONSENT_ANALYTICS`/`CONSENT_MARKETING` keys,
+so the two surfaces describe the SAME cookies from two angles: a banner (broad, cookie-law-shaped)
+and a per-purpose settings screen (granular, marketing-shaped). A runtime wiring both must keep a
+`trackers.*` decision and the matching cookie-consent category in sync — this package supplies the
+seam (`MarketingConsentBridge`) but not the wiring itself, which is server- or client-specific.
+
+Pure contracts, like `@owlmeans/oauth`: constants, types, AJV schemas, an immutable protocol-tree
+factory, pure resolution functions and an error family. No server, no storage, no React — a
+`@owlmeans/server-marketing-consent` (decision log, handlers) and a
+`@owlmeans/web-marketing-consent` (settings screen, sign-in step) are separate, unbuilt packages
+that would depend on this one.
+
+## The 8 standard keys
+
+`STANDARD_MARKETING_CONSENTS` — every key `opt-in`, ordered 10..80, grouped under
+`MC_GROUP_COMMUNICATIONS` / `MC_GROUP_DATA` / `MC_GROUP_TRACKERS`:
+
+| Constant | Key | Group | `cookieCategory` | `honorGpc` |
+|---|---|---|---|---|
+| `MC_EMAIL` | `marketing.email` | communications | — | — |
+| `MC_SMS` | `marketing.sms` | communications | — | — |
+| `MC_PHONE` | `marketing.phone` | communications | — | — |
+| `MC_PUSH` | `marketing.push` | communications | — | — |
+| `MC_PROFILING` | `data.profiling` | data | — | — |
+| `MC_PARTNERS` | `data.partners` | data | — | yes |
+| `MC_ANALYTICS` | `trackers.analytics` | trackers | `CONSENT_ANALYTICS` | — |
+| `MC_ADVERTISING` | `trackers.advertising` | trackers | `CONSENT_MARKETING` | yes |
+
+`STANDARD_REVISION` is the wording revision every standard definition is stamped with. Bump it (an
+ISO date) whenever the standard wording changes — a saved decision under the old revision becomes
+`'revised'` and is re-asked. Each `labelKey`/`descriptionKey` is `consent.<key>.label` /
+`consent.<key>.description` — the key's own dots, e.g. `consent.trackers.advertising.label` — and
+resolves through `MARKETING_CONSENT_I18N` (`'marketing-consent'`).
+
+## Resolving an application's catalogue — `resolveMarketingConsents(cfg?)`
+
+```ts
+import { resolveMarketingConsents } from '@owlmeans/marketing-consent'
+
+const defs = resolveMarketingConsents({
+  standard: {
+    'marketing.sms': false,                            // drop a standard key entirely
+    'marketing.email': { labelKey: 'app.email.label' }, // reword one; key/group never change
+  },
+  custom: [{ key: 'app.newsletter', group: 'communications', mode: 'opt-in' }],
+  links: { 'data.partners': [{ href: 'https://example.com/partners' }] },
+})
+```
+
+Order: start from `STANDARD_MARKETING_CONSENTS`, apply `cfg.standard[key]` (a `false` drops it, an
+object partially overrides it — never `key`/`group`), append `cfg.custom` (defaulted `mode:
+'opt-in'`, `enabled: true`, `revisedAt: cfg.revisedAt ?? STANDARD_REVISION`), merge `cfg.links[key]`
+into that definition's `links` (concatenated, de-duplicated by `href`), then drop anything with
+`enabled === false` and sort by `order ?? 1000` (ties keep first-seen order — standard before
+custom, declaration order within each).
+
+## Status and the decision table — `consentStatus(defs, decisions, opts?)`
+
+For each resolved definition, find the LATEST decision by `key` (max `decidedAt` — `decisions` may
+hold history) and classify:
+
+| Saved? | `revisedAt`/`mode` match? | Status |
+|---|---|---|
+| no | — | `new` |
+| yes | no | `revised` |
+| yes | yes | `current` |
+
+Initial `granted`:
+
+| Status | `opt-in` | `opt-out` |
+|---|---|---|
+| `current` | `saved.granted` | `saved.granted` |
+| `new` | `false` | `true`, unless `honorGpc && opts.gpc` → `false` |
+| `revised` | `false` | `saved.granted` (their last answer persists), unless `honorGpc && opts.gpc` → forced `false` |
+
+`updated` is `true` on `revised`, and on `new` when `decisions.length > 0` — i.e. this person has
+answered other consents before, just never this one, so the UI can say "Updated" instead of
+treating a first-ever visitor specially. `view.pending` is `true` iff any item is not `current`.
+`view.terms` is attached only when `opts.termsAcceptedAt` is given.
+
+**GPC (`honorGpc`)** only ever suppresses a grant — it never grants something the definition itself
+would deny, and it never overrides an opt-in default (which starts denied anyway). Only
+`data.partners` and `trackers.advertising` carry it in the standard set: those are the two rows
+with a real US "sale/share"/cross-context-advertising opt-out analogue.
+
+## Protocol tree — `makeMarketingConsentProtocols(opts?)`
+
+Same shape as `@owlmeans/oauth`'s `makeOAuthProtocols` / `@owlmeans/planning`'s
+`makePlanningProtocols`: one base carrying the guard (and optional gate), four leaves hanging under
+it, plus a parentless sticky screen.
+
+```ts
+const tree = makeMarketingConsentProtocols({
+  parent: 'app:account',                    // OR: guards: 'guard:default', gate: { alias, params? }
+  path: '/marketing-consent',               // default MARKETING_CONSENT_API_PATH
+  screen: { path: '/consent/marketing' },   // default MARKETING_CONSENT_SCREEN_PATH
+})
+// tree.base, tree.status (GET), tree.save (POST), tree.terms (POST), tree.screen (frontend, sticky)
+```
+
+`parent` and `guards`/`gate` are exclusive, the same rule as every other guarded base in this repo:
+a `parent` inherits that route's guards/gate; no `parent` means the base MUST carry `guards` itself
+— status/save/terms always act on the caller's own saved decisions, so there is no ungated shape.
+Passing neither throws `SyntaxError` at declaration time (a wiring mistake, not a runtime one).
+`save`'s request body is schema-checked (`SaveMarketingConsentSchema` — 1..64 decisions, `source`
+one of `'sign-in' | 'settings' | 'cookie'`, never `'api'`); `terms`'s is `TermsAcceptanceSchema`.
+
+## Errors
+
+`MarketingConsentError` (family `marketing-consent:*`, base `ResilientError`) and
+`UnknownMarketingConsentError` — raise the latter when a `SaveMarketingConsentRequest` decision
+names a key that `resolveMarketingConsents` did not produce for this application; do not silently
+drop it, because a dropped decision is a decision the person believes they made and did not.
+
+## Legal matrix
+
+Rows named `Key` and jurisdiction citations for what each consent gates. **This is not legal
+advice** — article numbers are believed correct as of September 2026 and must be reverified before
+being relied on. `honorGpc` in the standard set is what wires the Global Privacy Control column
+below into `consentStatus`'s decision table.
+
+| Key | EU / PL / DE / FR | US |
+|---|---|---|
+| `marketing.email` | ePrivacy Art.13(1); PL Prawo komunikacji elektronicznej art.398 (per-channel consent, in force since 10 Nov 2024); DE UWG §7(2) Nr.2; FR CPCE L.34-5 | CAN-SPAM (opt-out baseline; this package defaults to the stricter opt-in) |
+| `marketing.sms` | same as email | TCPA prior express written consent; revocation by any reasonable means (FCC rule effective 11 Apr 2025); must not condition purchase on consent |
+| `marketing.phone` | PKE art.398; DE UWG §7(2) Nr.1 + §7a (written proof kept 5 years after each use) | TCPA + Telemarketing Sales Rule / Do-Not-Call |
+| `marketing.push` | ePrivacy Art.5(3)/13; PKE art.398/399; DE TDDDG §25 | OS-level permission is separate; this consent gates the SEND, not the OS permission |
+| `data.profiling` | GDPR Art.6(1)(a) taken as the lawful basis (worst case vs. legitimate interest), Art.21(2)-(3) right to object, Art.22 no solely-automated decisions | state privacy laws' opt-out of profiling/targeted advertising |
+| `data.partners` | GDPR Art.6(1)(a) + Art.13(1)(e) recipients disclosure; CNIL 2022 guidance on partner lists for e-prospecting | CCPA/CPRA "sale/share" opt-out; honor Global Privacy Control (`honorGpc`) |
+| `trackers.analytics` | ePrivacy Art.5(3); PL PKE art.399; DE TDDDG §25; CNIL cookie guidance; Planet49 (CJEU C-673/17) bars pre-ticked boxes | CCPA "sharing" definition can include analytics cookies |
+| `trackers.advertising` | same as analytics, plus Google's EU User Consent Policy / Consent Mode v2 (`ad_user_data`, `ad_personalization`) | CCPA cross-context behavioral-advertising opt-out; GPC |
+
+Consent must be freely given (GDPR Art.7(4) — nothing here may be a condition of using the
+product), granular per purpose (EDPB Guidelines 05/2020), an active opt-in with no pre-ticked boxes
+(Recital 32, Planet49), withdrawable as easily as it was given (Art.7(3)), and demonstrable
+(Art.7(1) — this is why a future `@owlmeans/server-marketing-consent` keeps an append-only decision
+log rather than overwriting `MarketingConsentDecision` rows in place).
+
+## Key exports
+
+| Export | Description |
+|---|---|
+| `MC_EMAIL` … `MC_ADVERTISING` | The 8 standard consent keys |
+| `MC_GROUP_COMMUNICATIONS` · `MC_GROUP_DATA` · `MC_GROUP_TRACKERS` | The 3 groups |
+| `STANDARD_REVISION` · `STANDARD_MARKETING_CONSENTS` | The wording revision and the standard catalogue |
+| `MARKETING_CONSENT_SERVICE` · `MARKETING_CONSENT_I18N` · `MARKETING_CONSENT_API_PATH` · `MARKETING_CONSENT_SCREEN_PATH` | Service/i18n/wire identifiers |
+| `MARKETING_CONSENT_BASE` · `MARKETING_CONSENT_STATUS` · `MARKETING_CONSENT_SAVE` · `MARKETING_CONSENT_TERMS` · `MARKETING_CONSENT_SCREEN` | Protocol-tree aliases |
+| `resolveMarketingConsents(cfg?)` · `consentStatus(defs, decisions, opts?)` | Pure resolution |
+| `makeMarketingConsentProtocols(opts?)` | The protocol tree |
+| `SaveMarketingConsentSchema` · `TermsAcceptanceSchema` | AJV request schemas |
+| `MarketingConsentError` · `UnknownMarketingConsentError` | Errors |
+| Types | `MarketingConsentDefinition`, `MarketingConsentConfig`, `MarketingConsentDecision`, `MarketingConsentStatusView`/`Item`, `TermsAcceptance`, `SaveMarketingConsentRequest`, `MarketingConsentBridge`, `MarketingConsentEntrypointOptions`/`Entrypoints` |
+
+Importing `@owlmeans/marketing-consent` also registers its 8-language i18n bundle
+(`en`/`pl`/`ru`/`be`/`uk`/`es`/`de`/`fr` — `CONSENT_LOCALES`, one more than `@owlmeans/i18n`'s own
+`SUPPORTED_LNGS` because it shares `fr` with `@owlmeans/consent`) as a side effect, the same as
+`@owlmeans/payment` and `@owlmeans/planning` do.

package/build/consts.d.ts

@@ -0,0 +1,32 @@
+import type { MarketingConsentDefinition } from './types.js';
+export declare const MC_EMAIL = "marketing.email";
+export declare const MC_SMS = "marketing.sms";
+export declare const MC_PHONE = "marketing.phone";
+export declare const MC_PUSH = "marketing.push";
+export declare const MC_PROFILING = "data.profiling";
+export declare const MC_PARTNERS = "data.partners";
+export declare const MC_ANALYTICS = "trackers.analytics";
+export declare const MC_ADVERTISING = "trackers.advertising";
+export declare const MC_GROUP_COMMUNICATIONS = "communications";
+export declare const MC_GROUP_DATA = "data";
+export declare const MC_GROUP_TRACKERS = "trackers";
+/**
+ * The wording revision the standard catalogue was last updated at.
+ *
+ * Bump this (and any `revisedAt` it seeds) whenever the standard wording changes — a person who
+ * already answered under an earlier revision is then asked again (`consentStatus`'s `'revised'`
+ * status), never silently carried over onto new language.
+ */
+export declare const STANDARD_REVISION = "2026-09-22";
+/** The 8 standard marketing/data/tracker consents, in their default order. */
+export declare const STANDARD_MARKETING_CONSENTS: MarketingConsentDefinition[];
+export declare const MARKETING_CONSENT_SERVICE = "marketing-consent";
+export declare const MARKETING_CONSENT_I18N = "marketing-consent";
+export declare const MARKETING_CONSENT_API_PATH = "/marketing-consent";
+export declare const MARKETING_CONSENT_SCREEN_PATH = "/consent/marketing";
+export declare const MARKETING_CONSENT_BASE = "marketing-consent";
+export declare const MARKETING_CONSENT_STATUS = "marketing-consent:status";
+export declare const MARKETING_CONSENT_SAVE = "marketing-consent:save";
+export declare const MARKETING_CONSENT_TERMS = "marketing-consent:terms";
+export declare const MARKETING_CONSENT_SCREEN = "marketing-consent:screen";
+//# sourceMappingURL=consts.d.ts.map

package/build/consts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA;AAI5D,eAAO,MAAM,QAAQ,oBAAoB,CAAA;AACzC,eAAO,MAAM,MAAM,kBAAkB,CAAA;AACrC,eAAO,MAAM,QAAQ,oBAAoB,CAAA;AACzC,eAAO,MAAM,OAAO,mBAAmB,CAAA;AACvC,eAAO,MAAM,YAAY,mBAAmB,CAAA;AAC5C,eAAO,MAAM,WAAW,kBAAkB,CAAA;AAC1C,eAAO,MAAM,YAAY,uBAAuB,CAAA;AAChD,eAAO,MAAM,cAAc,yBAAyB,CAAA;AAIpD,eAAO,MAAM,uBAAuB,mBAAmB,CAAA;AACvD,eAAO,MAAM,aAAa,SAAS,CAAA;AACnC,eAAO,MAAM,iBAAiB,aAAa,CAAA;AAE3C;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,eAAe,CAAA;AAO7C,8EAA8E;AAC9E,eAAO,MAAM,2BAA2B,EAAE,0BAA0B,EAqFnE,CAAA;AAID,eAAO,MAAM,yBAAyB,sBAAsB,CAAA;AAC5D,eAAO,MAAM,sBAAsB,sBAAsB,CAAA;AACzD,eAAO,MAAM,0BAA0B,uBAAuB,CAAA;AAC9D,eAAO,MAAM,6BAA6B,uBAAuB,CAAA;AAIjE,eAAO,MAAM,sBAAsB,sBAAsB,CAAA;AACzD,eAAO,MAAM,wBAAwB,6BAA6B,CAAA;AAClE,eAAO,MAAM,sBAAsB,2BAA2B,CAAA;AAC9D,eAAO,MAAM,uBAAuB,4BAA4B,CAAA;AAChE,eAAO,MAAM,wBAAwB,6BAA6B,CAAA"}

package/build/consts.js

@@ -0,0 +1,125 @@
+import { CONSENT_ANALYTICS, CONSENT_MARKETING } from '@owlmeans/consent';
+// --- Consent keys ------------------------------------------------------------------------------
+export const MC_EMAIL = 'marketing.email';
+export const MC_SMS = 'marketing.sms';
+export const MC_PHONE = 'marketing.phone';
+export const MC_PUSH = 'marketing.push';
+export const MC_PROFILING = 'data.profiling';
+export const MC_PARTNERS = 'data.partners';
+export const MC_ANALYTICS = 'trackers.analytics';
+export const MC_ADVERTISING = 'trackers.advertising';
+// --- Consent groups ------------------------------------------------------------------------------
+export const MC_GROUP_COMMUNICATIONS = 'communications';
+export const MC_GROUP_DATA = 'data';
+export const MC_GROUP_TRACKERS = 'trackers';
+/**
+ * The wording revision the standard catalogue was last updated at.
+ *
+ * Bump this (and any `revisedAt` it seeds) whenever the standard wording changes — a person who
+ * already answered under an earlier revision is then asked again (`consentStatus`'s `'revised'`
+ * status), never silently carried over onto new language.
+ */
+export const STANDARD_REVISION = '2026-09-22';
+/** `'marketing.email'` -> `'consent.marketing.email.label'` — the key's own dots become the i18n
+ * path's dots, so the bundle nests exactly as the key reads (`src/i18n/en.json`'s `consent.*`). */
+const labelOf = (key) => `consent.${key}.label`;
+const descriptionOf = (key) => `consent.${key}.description`;
+/** The 8 standard marketing/data/tracker consents, in their default order. */
+export const STANDARD_MARKETING_CONSENTS = [
+    {
+        key: MC_EMAIL,
+        group: MC_GROUP_COMMUNICATIONS,
+        mode: 'opt-in',
+        enabled: true,
+        revisedAt: STANDARD_REVISION,
+        labelKey: labelOf(MC_EMAIL),
+        descriptionKey: descriptionOf(MC_EMAIL),
+        order: 10,
+    },
+    {
+        key: MC_SMS,
+        group: MC_GROUP_COMMUNICATIONS,
+        mode: 'opt-in',
+        enabled: true,
+        revisedAt: STANDARD_REVISION,
+        labelKey: labelOf(MC_SMS),
+        descriptionKey: descriptionOf(MC_SMS),
+        order: 20,
+    },
+    {
+        key: MC_PHONE,
+        group: MC_GROUP_COMMUNICATIONS,
+        mode: 'opt-in',
+        enabled: true,
+        revisedAt: STANDARD_REVISION,
+        labelKey: labelOf(MC_PHONE),
+        descriptionKey: descriptionOf(MC_PHONE),
+        order: 30,
+    },
+    {
+        key: MC_PUSH,
+        group: MC_GROUP_COMMUNICATIONS,
+        mode: 'opt-in',
+        enabled: true,
+        revisedAt: STANDARD_REVISION,
+        labelKey: labelOf(MC_PUSH),
+        descriptionKey: descriptionOf(MC_PUSH),
+        order: 40,
+    },
+    {
+        key: MC_PROFILING,
+        group: MC_GROUP_DATA,
+        mode: 'opt-in',
+        enabled: true,
+        revisedAt: STANDARD_REVISION,
+        labelKey: labelOf(MC_PROFILING),
+        descriptionKey: descriptionOf(MC_PROFILING),
+        order: 50,
+    },
+    {
+        key: MC_PARTNERS,
+        group: MC_GROUP_DATA,
+        mode: 'opt-in',
+        enabled: true,
+        revisedAt: STANDARD_REVISION,
+        labelKey: labelOf(MC_PARTNERS),
+        descriptionKey: descriptionOf(MC_PARTNERS),
+        honorGpc: true,
+        order: 60,
+    },
+    {
+        key: MC_ANALYTICS,
+        group: MC_GROUP_TRACKERS,
+        mode: 'opt-in',
+        enabled: true,
+        revisedAt: STANDARD_REVISION,
+        labelKey: labelOf(MC_ANALYTICS),
+        descriptionKey: descriptionOf(MC_ANALYTICS),
+        cookieCategory: CONSENT_ANALYTICS,
+        order: 70,
+    },
+    {
+        key: MC_ADVERTISING,
+        group: MC_GROUP_TRACKERS,
+        mode: 'opt-in',
+        enabled: true,
+        revisedAt: STANDARD_REVISION,
+        labelKey: labelOf(MC_ADVERTISING),
+        descriptionKey: descriptionOf(MC_ADVERTISING),
+        cookieCategory: CONSENT_MARKETING,
+        honorGpc: true,
+        order: 80,
+    },
+];
+// --- Service / i18n / wire identifiers -----------------------------------------------------
+export const MARKETING_CONSENT_SERVICE = 'marketing-consent';
+export const MARKETING_CONSENT_I18N = 'marketing-consent';
+export const MARKETING_CONSENT_API_PATH = '/marketing-consent';
+export const MARKETING_CONSENT_SCREEN_PATH = '/consent/marketing';
+// --- Protocol tree aliases -----------------------------------------------------------------
+export const MARKETING_CONSENT_BASE = 'marketing-consent';
+export const MARKETING_CONSENT_STATUS = 'marketing-consent:status';
+export const MARKETING_CONSENT_SAVE = 'marketing-consent:save';
+export const MARKETING_CONSENT_TERMS = 'marketing-consent:terms';
+export const MARKETING_CONSENT_SCREEN = 'marketing-consent:screen';
+//# sourceMappingURL=consts.js.map

package/build/consts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAGxE,kGAAkG;AAElG,MAAM,CAAC,MAAM,QAAQ,GAAG,iBAAiB,CAAA;AACzC,MAAM,CAAC,MAAM,MAAM,GAAG,eAAe,CAAA;AACrC,MAAM,CAAC,MAAM,QAAQ,GAAG,iBAAiB,CAAA;AACzC,MAAM,CAAC,MAAM,OAAO,GAAG,gBAAgB,CAAA;AACvC,MAAM,CAAC,MAAM,YAAY,GAAG,gBAAgB,CAAA;AAC5C,MAAM,CAAC,MAAM,WAAW,GAAG,eAAe,CAAA;AAC1C,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAA;AAChD,MAAM,CAAC,MAAM,cAAc,GAAG,sBAAsB,CAAA;AAEpD,oGAAoG;AAEpG,MAAM,CAAC,MAAM,uBAAuB,GAAG,gBAAgB,CAAA;AACvD,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAA;AACnC,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAA;AAE3C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,YAAY,CAAA;AAE7C;mGACmG;AACnG,MAAM,OAAO,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,WAAW,GAAG,QAAQ,CAAA;AAC/D,MAAM,aAAa,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,WAAW,GAAG,cAAc,CAAA;AAE3E,8EAA8E;AAC9E,MAAM,CAAC,MAAM,2BAA2B,GAAiC;IACvE;QACE,GAAG,EAAE,QAAQ;QACb,KAAK,EAAE,uBAAuB;QAC9B,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,iBAAiB;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC;QAC3B,cAAc,EAAE,aAAa,CAAC,QAAQ,CAAC;QACvC,KAAK,EAAE,EAAE;KACV;IACD;QACE,GAAG,EAAE,MAAM;QACX,KAAK,EAAE,uBAAuB;QAC9B,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,iBAAiB;QAC5B,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC;QACzB,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC;QACrC,KAAK,EAAE,EAAE;KACV;IACD;QACE,GAAG,EAAE,QAAQ;QACb,KAAK,EAAE,uBAAuB;QAC9B,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,iBAAiB;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC;QAC3B,cAAc,EAAE,aAAa,CAAC,QAAQ,CAAC;QACvC,KAAK,EAAE,EAAE;KACV;IACD;QACE,GAAG,EAAE,OAAO;QACZ,KAAK,EAAE,uBAAuB;QAC9B,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,iBAAiB;QAC5B,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC;QAC1B,cAAc,EAAE,aAAa,CAAC,OAAO,CAAC;QACtC,KAAK,EAAE,EAAE;KACV;IACD;QACE,GAAG,EAAE,YAAY;QACjB,KAAK,EAAE,aAAa;QACpB,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,iBAAiB;QAC5B,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC;QAC/B,cAAc,EAAE,aAAa,CAAC,YAAY,CAAC;QAC3C,KAAK,EAAE,EAAE;KACV;IACD;QACE,GAAG,EAAE,WAAW;QAChB,KAAK,EAAE,aAAa;QACpB,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,iBAAiB;QAC5B,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC;QAC9B,cAAc,EAAE,aAAa,CAAC,WAAW,CAAC;QAC1C,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,EAAE;KACV;IACD;QACE,GAAG,EAAE,YAAY;QACjB,KAAK,EAAE,iBAAiB;QACxB,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,iBAAiB;QAC5B,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC;QAC/B,cAAc,EAAE,aAAa,CAAC,YAAY,CAAC;QAC3C,cAAc,EAAE,iBAAiB;QACjC,KAAK,EAAE,EAAE;KACV;IACD;QACE,GAAG,EAAE,cAAc;QACnB,KAAK,EAAE,iBAAiB;QACxB,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,iBAAiB;QAC5B,QAAQ,EAAE,OAAO,CAAC,cAAc,CAAC;QACjC,cAAc,EAAE,aAAa,CAAC,cAAc,CAAC;QAC7C,cAAc,EAAE,iBAAiB;QACjC,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,EAAE;KACV;CACF,CAAA;AAED,8FAA8F;AAE9F,MAAM,CAAC,MAAM,yBAAyB,GAAG,mBAAmB,CAAA;AAC5D,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAA;AACzD,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAA;AAC9D,MAAM,CAAC,MAAM,6BAA6B,GAAG,oBAAoB,CAAA;AAEjE,8FAA8F;AAE9F,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAA;AACzD,MAAM,CAAC,MAAM,wBAAwB,GAAG,0BAA0B,CAAA;AAClE,MAAM,CAAC,MAAM,sBAAsB,GAAG,wBAAwB,CAAA;AAC9D,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAA;AAChE,MAAM,CAAC,MAAM,wBAAwB,GAAG,0BAA0B,CAAA"}

package/build/entrypoints.d.ts

@@ -0,0 +1,13 @@
+import type { MarketingConsentEntrypointOptions, MarketingConsentEntrypoints } from './types.js';
+/**
+ * The guarded marketing-consent surface: read the current status, save decisions, record a
+ * terms acceptance — plus the top-level screen that hosts them.
+ *
+ * A base with a `parent` inherits that parent's guards and gate, the same as every other nested
+ * route. A base with no `parent` MUST carry `opts.guards` itself — status/save/terms always act
+ * on the caller's own saved decisions, so there is no ungated shape; neither given is a
+ * declaration error, not a runtime one, because it means the application forgot to mount this
+ * tree at all.
+ */
+export declare const makeMarketingConsentProtocols: (opts?: MarketingConsentEntrypointOptions) => MarketingConsentEntrypoints;
+//# sourceMappingURL=entrypoints.d.ts.map

package/build/entrypoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,iCAAiC,EAAE,2BAA2B,EAE/D,MAAM,YAAY,CAAA;AAEnB;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,UAAU,iCAAiC,KAAQ,2BAyC5F,CAAA"}

package/build/entrypoints.js

@@ -0,0 +1,36 @@
+import { contract, openProtocol, protocol, typed } from '@owlmeans/entrypoint';
+import { frontend, route, RouteMethod } from '@owlmeans/route';
+import { MARKETING_CONSENT_API_PATH, MARKETING_CONSENT_BASE, MARKETING_CONSENT_SAVE, MARKETING_CONSENT_SCREEN, MARKETING_CONSENT_SCREEN_PATH, MARKETING_CONSENT_STATUS, MARKETING_CONSENT_TERMS, } from './consts.js';
+import { SaveMarketingConsentSchema, TermsAcceptanceSchema } from './schemas.js';
+/**
+ * The guarded marketing-consent surface: read the current status, save decisions, record a
+ * terms acceptance — plus the top-level screen that hosts them.
+ *
+ * A base with a `parent` inherits that parent's guards and gate, the same as every other nested
+ * route. A base with no `parent` MUST carry `opts.guards` itself — status/save/terms always act
+ * on the caller's own saved decisions, so there is no ungated shape; neither given is a
+ * declaration error, not a runtime one, because it means the application forgot to mount this
+ * tree at all.
+ */
+export const makeMarketingConsentProtocols = (opts = {}) => {
+    const path = opts.path ?? MARKETING_CONSENT_API_PATH;
+    if (opts.parent == null && opts.guards == null) {
+        throw new SyntaxError('marketing-consent: guarded routes need either a parent or explicit guards');
+    }
+    const base = opts.parent != null
+        ? openProtocol(route(MARKETING_CONSENT_BASE, path, { parent: opts.parent }))
+        : openProtocol(route(MARKETING_CONSENT_BASE, path), {
+            guards: opts.guards,
+            ...(opts.gate != null ? { gate: opts.gate } : {}),
+        });
+    return {
+        base,
+        status: protocol(route(MARKETING_CONSENT_STATUS, '/status', { parent: MARKETING_CONSENT_BASE, method: RouteMethod.GET }), contract(typed())),
+        save: protocol(route(MARKETING_CONSENT_SAVE, '/save', { parent: MARKETING_CONSENT_BASE, method: RouteMethod.POST }), contract.request({ body: typed(SaveMarketingConsentSchema) }, typed())),
+        terms: protocol(route(MARKETING_CONSENT_TERMS, '/terms', { parent: MARKETING_CONSENT_BASE, method: RouteMethod.POST }), contract.request({ body: typed(TermsAcceptanceSchema) }, typed())),
+        // A top-level frontend screen, no parent, `sticky` so the router keeps it regardless of
+        // `cfg.service` filtering — the same shape as `@owlmeans/oauth`'s three consent screens.
+        screen: openProtocol(route(MARKETING_CONSENT_SCREEN, opts.screen?.path ?? MARKETING_CONSENT_SCREEN_PATH, frontend({ parent: opts.screen?.parent })), { sticky: true }),
+    };
+};
+//# sourceMappingURL=entrypoints.js.map

package/build/entrypoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entrypoints.js","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC9D,OAAO,EACL,0BAA0B,EAAE,sBAAsB,EAAE,sBAAsB,EAC1E,wBAAwB,EAAE,6BAA6B,EAAE,wBAAwB,EACjF,uBAAuB,GACxB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAMhF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,IAAI,GAAsC,EAAE,EAA+B,EAAE;IACzH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,0BAA0B,CAAA;IAEpD,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;QAC/C,MAAM,IAAI,WAAW,CAAC,2EAA2E,CAAC,CAAA;IACpG,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI;QAC9B,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,sBAAsB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5E,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,sBAAsB,EAAE,IAAI,CAAC,EAAE;YAChD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC,CAAA;IAEN,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,QAAQ,CACd,KAAK,CAAC,wBAAwB,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE,CAAC,EACvG,QAAQ,CAAC,KAAK,EAA8B,CAAC,CAC9C;QACD,IAAI,EAAE,QAAQ,CACZ,KAAK,CAAC,sBAAsB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC,EACpG,QAAQ,CAAC,OAAO,CACd,EAAE,IAAI,EAAE,KAAK,CAA8B,0BAA0B,CAAC,EAAE,EACxE,KAAK,EAAuD,CAC7D,CACF;QACD,KAAK,EAAE,QAAQ,CACb,KAAK,CAAC,uBAAuB,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC,EACtG,QAAQ,CAAC,OAAO,CACd,EAAE,IAAI,EAAE,KAAK,CAAkB,qBAAqB,CAAC,EAAE,EACvD,KAAK,EAAmB,CACzB,CACF;QACD,wFAAwF;QACxF,yFAAyF;QACzF,MAAM,EAAE,YAAY,CAClB,KAAK,CAAC,wBAAwB,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,6BAA6B,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,EAC9H,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB;KACF,CAAA;AACH,CAAC,CAAA"}

package/build/errors.d.ts

@@ -0,0 +1,14 @@
+import { ResilientError } from '@owlmeans/error';
+/** The marketing-consent error family — refusals a status/save/terms handler raises. */
+export declare class MarketingConsentError extends ResilientError {
+    static typeName: string;
+    constructor(message?: string);
+}
+/** A `SaveMarketingConsentRequest` decision named a key that no resolved definition carries. */
+export declare class UnknownMarketingConsentError extends MarketingConsentError {
+    static typeName: string;
+    /** A bad request, not a server fault — the caller named a key this deployment does not have. */
+    static httpStatus: number;
+    constructor(message?: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/build/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,wFAAwF;AACxF,qBAAa,qBAAsB,SAAQ,cAAc;IACvD,OAAuB,QAAQ,EAAE,MAAM,CAA0B;IAEjE,YAAY,OAAO,GAAE,MAAgB,EAEpC;CACF;AAED,gGAAgG;AAChG,qBAAa,4BAA6B,SAAQ,qBAAqB;IACrE,OAAuB,QAAQ,EAAE,MAAM,CAA6C;IACpF,gGAAgG;IAChG,OAAc,UAAU,SAAM;IAE9B,YAAY,OAAO,GAAE,MAAgB,EAGpC;CACF"}

package/build/errors.js

@@ -0,0 +1,21 @@
+import { ResilientError } from '@owlmeans/error';
+/** The marketing-consent error family — refusals a status/save/terms handler raises. */
+export class MarketingConsentError extends ResilientError {
+    static typeName = 'MarketingConsentError';
+    constructor(message = 'error') {
+        super(MarketingConsentError.typeName, `marketing-consent:${message}`);
+    }
+}
+/** A `SaveMarketingConsentRequest` decision named a key that no resolved definition carries. */
+export class UnknownMarketingConsentError extends MarketingConsentError {
+    static typeName = `${MarketingConsentError.typeName}Unknown`;
+    /** A bad request, not a server fault — the caller named a key this deployment does not have. */
+    static httpStatus = 400;
+    constructor(message = 'error') {
+        super(`unknown:${message}`);
+        this.type = UnknownMarketingConsentError.typeName;
+    }
+}
+ResilientError.registerErrorClass(MarketingConsentError);
+ResilientError.registerErrorClass(UnknownMarketingConsentError);
+//# sourceMappingURL=errors.js.map

package/build/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,wFAAwF;AACxF,MAAM,OAAO,qBAAsB,SAAQ,cAAc;IAChD,MAAM,CAAU,QAAQ,GAAW,uBAAuB,CAAA;IAEjE,YAAY,OAAO,GAAW,OAAO;QACnC,KAAK,CAAC,qBAAqB,CAAC,QAAQ,EAAE,qBAAqB,OAAO,EAAE,CAAC,CAAA;IACvE,CAAC;CACF;AAED,gGAAgG;AAChG,MAAM,OAAO,4BAA6B,SAAQ,qBAAqB;IAC9D,MAAM,CAAU,QAAQ,GAAW,GAAG,qBAAqB,CAAC,QAAQ,SAAS,CAAA;IACpF,gGAAgG;IACzF,MAAM,CAAC,UAAU,GAAG,GAAG,CAAA;IAE9B,YAAY,OAAO,GAAW,OAAO;QACnC,KAAK,CAAC,WAAW,OAAO,EAAE,CAAC,CAAA;QAC3B,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC,QAAQ,CAAA;IACnD,CAAC;CACF;AAED,cAAc,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;AACxD,cAAc,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,CAAA"}

package/build/i18n/be.json

@@ -0,0 +1,62 @@
+{
+    "group": {
+        "communications": {
+            "title": "Камунікацыі",
+            "description": "Як мы з вамі звязваемся."
+        },
+        "data": {
+            "title": "Выкарыстанне дадзеных",
+            "description": "Як выкарыстоўваюцца і перадаюцца вашы дадзеныя."
+        },
+        "trackers": {
+            "title": "Трэкеры",
+            "description": "Аналітычныя і рэкламныя тэхналогіі."
+        }
+    },
+    "consent": {
+        "marketing": {
+            "email": {
+                "label": "Прапановы і навіны на email",
+                "description": "Навіны пра прадукт, прапановы і абнаўленні па электроннай пошце."
+            },
+            "sms": {
+                "label": "SMS-паведамленні",
+                "description": "Прапановы і абнаўленні ў выглядзе тэкставых паведамленняў."
+            },
+            "phone": {
+                "label": "Тэлефонныя званкі",
+                "description": "Прапановы і абнаўленні па тэлефоне."
+            },
+            "push": {
+                "label": "Push-паведамленні",
+                "description": "Прапановы і абнаўленні ў выглядзе push-паведамленняў."
+            }
+        },
+        "data": {
+            "profiling": {
+                "label": "Персаналізацыя",
+                "description": "Выкарыстанне вашай актыўнасці для персаналізацыі таго, што вы бачыце."
+            },
+            "partners": {
+                "label": "Перадача партнёрам",
+                "description": "Перадача вашых дадзеных абраным партнёрам для іх уласнага маркетынгу."
+            }
+        },
+        "trackers": {
+            "analytics": {
+                "label": "Аналітычныя cookie",
+                "description": "Cookie, якія дапамагаюць зразумець, як выкарыстоўваецца прадукт."
+            },
+            "advertising": {
+                "label": "Рэкламныя cookie",
+                "description": "Cookie, якія выкарыстоўваюцца для вымярэння і персаналізацыі рэкламы."
+            }
+        }
+    },
+    "link": {
+        "default": "Даведацца больш"
+    },
+    "errors": {
+        "unknown": "Невядомая згода: {{key}}"
+    }
+}

package/build/i18n/de.json

@@ -0,0 +1,62 @@
+{
+    "group": {
+        "communications": {
+            "title": "Kommunikation",
+            "description": "Wie wir Sie kontaktieren."
+        },
+        "data": {
+            "title": "Datennutzung",
+            "description": "Wie Ihre Daten verwendet und weitergegeben werden."
+        },
+        "trackers": {
+            "title": "Tracker",
+            "description": "Analyse- und Werbetechnologien."
+        }
+    },
+    "consent": {
+        "marketing": {
+            "email": {
+                "label": "Angebote und Neuigkeiten per E-Mail",
+                "description": "Produktneuigkeiten, Angebote und Updates per E-Mail."
+            },
+            "sms": {
+                "label": "SMS-Nachrichten",
+                "description": "Angebote und Updates per Textnachricht."
+            },
+            "phone": {
+                "label": "Telefonanrufe",
+                "description": "Angebote und Updates per Telefonanruf."
+            },
+            "push": {
+                "label": "Push-Benachrichtigungen",
+                "description": "Angebote und Updates als Push-Benachrichtigungen."
+            }
+        },
+        "data": {
+            "profiling": {
+                "label": "Personalisierung",
+                "description": "Nutzung Ihrer Aktivität, um Inhalte für Sie zu personalisieren."
+            },
+            "partners": {
+                "label": "Weitergabe an Partner",
+                "description": "Weitergabe Ihrer Daten an ausgewählte Partner für deren eigenes Marketing."
+            }
+        },
+        "trackers": {
+            "analytics": {
+                "label": "Analyse-Cookies",
+                "description": "Cookies, die uns helfen zu verstehen, wie das Produkt genutzt wird."
+            },
+            "advertising": {
+                "label": "Werbe-Cookies",
+                "description": "Cookies zur Messung und Personalisierung von Werbung."
+            }
+        }
+    },
+    "link": {
+        "default": "Mehr erfahren"
+    },
+    "errors": {
+        "unknown": "Unbekannte Einwilligung: {{key}}"
+    }
+}