@owlmeans/web-gtm 0.1.18-rc.3 → 0.1.18-rc.30

package/README.md

@@ -0,0 +1,15 @@
+<!-- owlmeans:agent-guidance:start -->
+## Agent guidance
+
+This package ships embedded agent skills under `agent-meta/`. After installing your
+`@owlmeans/*` packages, run the OwlMeans agent-skills installer to place them into
+your project's skill store (`.agents/skills/`):
+
+```sh
+npx @owlmeans/agent-skills@^0.1.18-rc.39
+```
+
+The embedded files are version-matched to this package release. Do not edit them
+directly — they are regenerated on each publish. To contribute guidance edits,
+open a PR against the source monorepo.
+<!-- owlmeans:agent-guidance:end -->

package/agent-meta/manifest.json

@@ -0,0 +1,16 @@
+{
+  "schemaVersion": 2,
+  "package": "@owlmeans/web-gtm",
+  "version": "0.1.18-rc.30",
+  "generatedAt": "2026-09-24T14:00:35.009Z",
+  "canonicalRepo": "https://github.com/owlmeans/common",
+  "entries": [
+    {
+      "kind": "skill",
+      "name": "web-gtm",
+      "category": "package-specific",
+      "file": "skills/web-gtm/SKILL.md",
+      "canonicalPath": ".agents/skills/web-gtm/SKILL.md"
+    }
+  ]
+}

package/agent-meta/skills/web-gtm/SKILL.md

@@ -0,0 +1,222 @@
+---
+name: web-gtm
+description: How to use @owlmeans/web-gtm — the Google tag head snippet for every Google id (Tag Manager GTM-, GA4 G-, Google tag GT-, Ads AW-, Floodlight DC-) that declares Consent Mode defaults before any loader runs, the id validator, the CSP host lists, the cookie-policy disclosure for a tag, the noscript frame, and the script-side loader for a host that cannot edit its own HTML. Auto-invoked when adding a Google tag or tag manager to a page, importing googleTagHeadScript, isGoogleTagId, GOOGLE_TAG_CSP_SOURCES, googleTagServices, gtmHeadScript, gtmNoscriptFrame or loadGtm, or debugging why a tag ignores a stored consent decision or is blocked by CSP.
+user-invocable: false
+---
+<!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
+
+# @owlmeans/web-gtm
+
+**Layer:** Web
+**Install:** `"@owlmeans/web-gtm": "^0.1.18-rc.30"` in `dependencies`
+
+The tag half of the consent set. It emits **strings and data**, not components, and it holds no
+state — the decision lives in `@owlmeans/consent`, which this package reads through
+`consentBootstrapScript` and `consentStore`.
+
+## The one idea: order
+
+A Google tag — the Tag Manager container or gtag.js alike — decides what it may do from the
+consent state present **when it loads**. A React bundle cannot get there first: by the time an
+island mounts, the tag has been running for hundreds of milliseconds and has already decided. A
+site whose defaults arrive after the loader is not configured differently — it is *unconfigured
+for the window that matters*, and nothing in the page reports it.
+
+So every head snippet here emits the consent bootstrap first and the loader after it, as ONE
+inline script. Everything else in this package exists to serve that.
+
+## Loading mode: gated by default
+
+`googleTagHeadScript`, `gtmHeadScript` and `loadGtm` all take an optional `mode:
+'basic' | 'advanced'`, defaulting to `GOOGLE_TAG_DEFAULT_MODE` — currently `'basic'`, one named
+constant so flipping the platform default later is a one-line change:
+
+| `mode` | What runs, and when |
+|---|---|
+| `'basic'` (default) | The bootstrap and the ads-redaction flags still run unconditionally — Consent Mode's own denied-by-default signals are declared either way. The LOADER itself — `gtm.js`, or `gtag/js` + `js` + `config` — is wrapped in `@owlmeans/consent`'s `consentGateScript`: it runs immediately if the visitor's stored record already `trackingGranted`, and otherwise waits for a later `CONSENT_EVENT` (from `applyConsent`, i.e. an in-page consent decision) that does. Nothing — not even Google's own IP receipt — reaches the tag before a signal-bearing category (`analytics` or `marketing` by default; a `required` or signal-less category never counts) is granted. |
+| `'advanced'` | The original, only behavior before this mode existed: the loader runs immediately, Consent Mode signals denied by default, so the tag itself starts receiving traffic cookielessly from first paint. This is Google's own recommended default for its conversion modeling, and remains available for a site that has decided that tradeoff is acceptable. |
+
+Read `'basic'`'s default as the EU/DE worst-case reading of ePrivacy Art. 5(3): no third party
+receives a connection before consent.
+
+`gtmNoscriptFrame` returns `''` in `'basic'` mode rather than an iframe — a browser with JavaScript
+disabled cannot have granted anything, so an unauthenticated `<noscript>` frame would defeat the
+whole point of gating. It keeps emitting the iframe in `'advanced'` mode, unchanged.
+
+`loadGtm` gates the same way at the DOM level: it still calls `consentStore.init(opts)` first, but
+only appends the container's `<script>` element once `trackingGranted(consentStore.get().record,
+opts.categories)` is true — immediately if already granted, or via a one-shot `consentStore.subscribe`
+that unsubscribes itself on the first update where it becomes true. The anti-double-load guard (the
+element's own id) is unchanged.
+
+None of this is new state: it is one more consumer of `@owlmeans/consent`'s existing surface —
+`trackingGranted(record, categories)` (whether a stored/applied record grants a signal-bearing,
+non-required category) and `consentGateScript(loaderExpr, opts)` (the inline script implementing the
+"run now or wait for `CONSENT_EVENT`" branch). Both live in `@owlmeans/consent`, not here, because a
+target project's own custom loader can reuse the same gate without depending on this package.
+
+## Key Exports
+
+| Export | Description |
+|--------|-------------|
+| `googleTagHeadScript(opts)` | The inline `<head>` script for any Google id: consent bootstrap, ads redaction, then the loader the prefix calls for — gated behind `consentGateScript` in `opts.mode`'s default, `'basic'`. **The default for new code** |
+| `isGoogleTagId(id)` / `googleTagKind(id)` | Whether an id is loadable, and whether it takes `gtm` (container) or `gtag` (gtag.js); `null` for anything else |
+| `GoogleTagOptions` / `GoogleTagKind` | `ConsentOptions` plus `id`, optional `dataLayerName` and `mode`; `'gtm' \| 'gtag'` |
+| `GoogleTagMode` / `GOOGLE_TAG_DEFAULT_MODE` | `'basic' \| 'advanced'`; the platform default, `'basic'` — see **Loading mode** below |
+| `GOOGLE_TAG_CSP_SOURCES` | The hosts GA4, Tag Manager and Google Ads need in `script-src`, `connect-src` and `img-src` (7, frozen) |
+| `GOOGLE_TAG_FRAME_SOURCES` | The hosts they frame, for `frame-src`: `https://www.googletagmanager.com`, `https://td.doubleclick.net` |
+| `googleTagServices(id)` | The `ConsentService[]` a cookie policy discloses for that tag — pass to `CookiePolicy`'s `services` |
+| `gtmHeadScript(opts)` | The container-only snippet: consent defaults, stored decision, then `gtm.js` — gated the same way as `googleTagHeadScript` |
+| `gtmNoscriptFrame(opts)` | The hidden `<noscript>` iframe, for the top of `<body>` — `''` in `'basic'` mode |
+| `loadGtm(opts)` | Script-side container load, for a host that cannot emit into its own head — gated the same way |
+| `GtmOptions` | `ConsentOptions` plus `id` (e.g. `GTM-XXXXXXX`), optional `dataLayerName` and `mode` |
+
+## Ids
+
+`isGoogleTagId` accepts exactly `GTM-` + 4–12, or `G-` / `GT-` / `AW-` / `DC-` + 4–16, upper-case
+letters and digits. It is strict on purpose: the id is typed into a settings form and ends up in
+an inline script and a script URL, and a value it accepts cannot carry a quote, a tag or a second
+query parameter — so **validate with it where the id is stored**, not only where it is emitted.
+Lower case is rejected rather than folded; normalise in the form if you want to be forgiving.
+`UA-` (Universal Analytics, retired) is rejected: it would promise measurement that never comes.
+
+| Prefix | Kind | Loader |
+|---|---|---|
+| `GTM-` | `gtm` | `gtm.js` — Google's container IIFE |
+| `G-` GA4, `GT-` Google tag, `AW-` Google Ads, `DC-` Floodlight | `gtag` | `gtag/js`, then `js` and `config` |
+
+## `googleTagHeadScript` — what it emits
+
+1. `consentBootstrapScript(opts)` — `consent/default` (everything denied except
+   `security_storage`) and, for a returning visitor, `consent/update` from the stored record.
+2. `set ads_data_redaction true` and `set url_passthrough false` — both have to precede the tag's
+   `config`. Redaction strips ad-click ids and goes cookieless while `ad_storage` is denied.
+3. The loader. For `gtag`: a queue function (published as `window.gtag` only when nothing else
+   owns it, so app code can send events), `js`, `config`, and the gtag.js `<script async>`
+   element created from the inline script — one inline script rather than Google's two elements,
+   so a build stamps one thing. The element carries id `owl-gtag-<id>`, so running the snippet
+   twice configures the tag once instead of double-counting page views. In `mode`'s default,
+   `'basic'`, this whole step 3 is what `consentGateScript` withholds — steps 1 and 2 always run;
+   pass `mode: 'advanced'` to run step 3 unconditionally too, as before this mode existed.
+
+An **invalid id yields the consent bootstrap alone, regardless of `mode`** — a mistyped tag must
+never cost a page its consent defaults. So a host may stamp `googleTagHeadScript({ id: configured
+})` unconditionally, or stamp `consentBootstrapScript()` when no tag is configured; both are
+correct.
+
+**The output is safe to place inline in HTML as-is.** JSON encoding keeps configured values inside
+their string literals, but the HTML parser ends a script element at the first `</script` wherever
+it sits, so every `</` and `<!--` in the output is backslash-escaped (`<\/`, `<\!--` — JavaScript
+reads them unchanged). `gtmHeadScript` predates this and does not escape; prefer
+`googleTagHeadScript` wherever category keys or a storage key come from configuration.
+
+## Stamping it
+
+```typescript
+import { googleTagHeadScript } from '@owlmeans/web-gtm'
+
+const head = googleTagHeadScript({ id: 'G-XXXXXXXXXX' })   // inline <script> content, first in <head>
+```
+
+The snippet is stamped **from HTML**, never from the application bundle:
+
+- a Vite app — a `transformIndexHtml` plugin substituting a marker, so the snippet cannot drift
+  from the package;
+- an Astro site — `owlHeadScripts()` from `@owlmeans/astro`, `set:html` in the base layout;
+- a **generated Viable app** — its Rollup build writes `index.html` and puts
+  `googleTagHeadScript({ id })` in the `<head>` when the project owner has set a Google tag
+  (`BRANDING_GOOGLE_TAG`), and `consentBootstrapScript()` otherwise. The tag is attached in
+  **preview and production** alike; the consent default is first in both.
+
+The snippet **reads the stored decision**, so the same `ConsentOptions` (categories, `storageKey`)
+must be passed here and to the dialog: two category sets in one page mean the snippet and the
+component disagree about what was asked.
+
+**Cross-domain consent needs nothing new here.** `GtmOptions`/`GoogleTagOptions` both extend
+`ConsentOptions`, so `linker` (see the `consent` skill's plugin-seam section) passed to either head
+script reaches `consentBootstrapScript` unchanged, which embeds the adopt-and-strip fragment right
+after `consent/default` when it is set:
+
+```typescript
+googleTagHeadScript({ id: 'GTM-XXXXXXX', linker: { domains: ['owlmeans.com', 'owlmeans.pl'] } })
+```
+
+An app that does not stamp a tag at all still gets the fragment from a bare
+`consentBootstrapScript({ linker: { domains } })`.
+
+## Content Security Policy
+
+A page served with a CSP must allow the tag's hosts, or the loader is blocked and nothing on the
+page says so.
+
+- `GOOGLE_TAG_CSP_SOURCES` goes into `script-src`, `connect-src` and `img-src` — one list for all
+  three, folded from Google's CSP guide (developers.google.com/tag-platform/security/guides/csp):
+  `*.googletagmanager.com`, `*.google-analytics.com`, `*.g.doubleclick.net`, `ad.doubleclick.net`,
+  `www.googleadservices.com`, `pagead2.googlesyndication.com`, `*.google.com`. Each is
+  `https://` + optional `*.` + a dotted host, the only shape the Viable publisher's source filter
+  admits, and few enough to fit its per-slot cap. Google's country domains (`google.<TLD>`) cannot
+  be expressed in that shape; what is lost is a remarketing ping, never the tag.
+- `GOOGLE_TAG_FRAME_SOURCES` goes into `frame-src`.
+- The inline head script itself is covered by the document's own script hash — the Viable
+  publisher derives `'sha256-…'` from the document it sends — so nothing else is needed for it.
+- **Tag Manager Custom HTML tags do not run under a hash-based CSP**: they inject inline scripts
+  no hash names, and `'unsafe-inline'` is not an option. Custom JavaScript variables need
+  `'unsafe-eval'` and fail the same way. Build a container for such a page from Google's
+  **built-in tag templates** (GA4, Google Ads, Floodlight, Conversion Linker) and Community
+  Gallery templates, which load from the allowed hosts.
+
+## Disclosing it
+
+`googleTagServices(id)` returns what the cookie policy lists under each category, read off the
+prefix — the page knows nothing more:
+
+| Id | Entries |
+|---|---|
+| `G-` | Google Analytics — `analytics`; `_ga`, `_ga_<id without G->` |
+| `AW-` | Google Ads — `marketing`; `_gcl_au`, `_gcl_aw` |
+| `DC-` | Floodlight — `marketing`; `_gcl_au`, `_gcl_dc` |
+| `GTM-`, `GT-` | one `analytics` AND one `marketing` entry, worded as "configured in the container" / "for it at Google" — the policy may not claim less than the tag can do |
+| invalid | `[]` — it loads nothing, so it discloses nothing |
+
+Pass them to `CookiePolicy` (`services`) wherever the tag is stamped; a generated Viable app's
+cookie page does so when a Google tag is set. The strings are English data, not translation keys.
+
+## Gotchas
+
+- **Consent Mode speaks on `window.dataLayer`.** The bootstrap and the dialog's later
+  `consent/update` both push there, so a tag given another `dataLayerName` never hears a consent
+  command. Leave `dataLayerName` unset on any consent-gated page; it exists for a page running a
+  second, separately-consented container. `googleTagHeadScript` falls back to `dataLayer` when the
+  name is not a plain identifier.
+- **Ids and queue names are injected as data, never interpolated raw.** `gtmHeadScript` and
+  `googleTagHeadScript` JSON-encode them; `gtmNoscriptFrame` URL-encodes the id so it cannot break
+  out of the attribute. Never build either string by hand.
+- **`loadGtm` is the fallback, not the default.** It is for a single-page app whose HTML is not
+  yours to edit. It still pushes the defaults first (through `consentStore.init`) and refuses to
+  load a second time — it marks its own `<script>` element with an id derived from the container —
+  but it runs after the bundle, which is exactly the window the head snippet closes. In `'basic'`
+  mode it additionally withholds the element itself until `trackingGranted`, same as the head
+  snippets.
+- **The default flipped to `'basic'`.** Code written before this mode existed called
+  `googleTagHeadScript({ id })` / `gtmHeadScript({ id })` expecting the tag to load unconditionally.
+  It now gates by default; pass `mode: 'advanced'` explicitly to keep the old behavior for a site
+  that has made that call deliberately.
+- **A second `consent/default` after a tag has loaded can WIDEN what was already narrowed**, so the
+  bootstrap is idempotent through a window flag. A page may therefore carry the call twice — once
+  inline, once from the bundle that mounts the dialog — without harm. Do not defeat the flag.
+- `loadGtm` returns immediately when there is no `document`, so it is safe to call from code that
+  also runs during server rendering.
+
+## Depends On
+
+- `@owlmeans/consent` — `consentBootstrapScript`, `consentStore`, `ConsentOptions`,
+  `ConsentService`, the category keys and the Consent Mode signal mapping, plus (for the `'basic'`
+  gated mode) `consentGateScript` and `trackingGranted`
+
+## Related
+
+- `consent` — categories, the storage record and its migration, Consent Mode v2 signalling, and the
+  ordering rule this package implements
+- `web-consent` — the dialog and the cookie-policy page (`services`) that produce and disclose the
+  decision
+- `astro` — `owlHeadScripts()`, which composes the head strings for an Astro layout

package/build/index.d.ts

@@ -1,9 +1,27 @@
-import type { ConsentOptions } from '@owlmeans/consent';
+import type { ConsentOptions, ConsentService } from '@owlmeans/consent';
+/** `'gtm'` container / `'gtag'` — see {@link GtmOptions.mode} / {@link GoogleTagOptions.mode}. */
+export type GoogleTagMode = 'basic' | 'advanced';
+/**
+ * The platform default for {@link GtmOptions.mode} / {@link GoogleTagOptions.mode}.
+ *
+ * One named constant so flipping it later is a one-line change.
+ *
+ * - `'basic'` withholds the loader until a signal-bearing category is granted — which holds back
+ *   Google's own IP receipt too, not only what a granted tag may then do with it.
+ * - `'advanced'` loads immediately with Consent Mode signals denied — today's only behavior, and
+ *   Google's own recommended default for its own conversion modeling.
+ *
+ * Default is `'basic'`: read it as the EU/DE worst-case reading of ePrivacy Art. 5(3) — no third
+ * party receives a connection before consent.
+ */
+export declare const GOOGLE_TAG_DEFAULT_MODE: GoogleTagMode;
 export interface GtmOptions extends ConsentOptions {
     /** Container id, e.g. `GTM-XXXXXXX`. */
     id: string;
     /** The queue name, when a page runs more than one container. */
     dataLayerName?: string;
+    /** See {@link GOOGLE_TAG_DEFAULT_MODE}. Defaults to `GOOGLE_TAG_DEFAULT_MODE` (`'basic'`). */
+    mode?: GoogleTagMode;
 }
 /**
  * The inline `<head>` snippet, consent first and the container second.
@@ -15,9 +33,20 @@ export interface GtmOptions extends ConsentOptions {
  * the window that matters, and nothing in the page reports it.
  *
  * Emit this into the document head, above everything else, as an inline script.
+ *
+ * In `GOOGLE_TAG_DEFAULT_MODE` (`'basic'`) the container is not requested at all until a
+ * signal-bearing category is granted — {@link consentGateScript} wraps it, reading any stored
+ * decision immediately and otherwise waiting for `@owlmeans/consent`'s `CONSENT_EVENT`. Pass
+ * `mode: 'advanced'` for the original, unconditional load.
  */
 export declare const gtmHeadScript: (opts: GtmOptions) => string;
-/** The `<noscript>` iframe, for the body. */
+/**
+ * The `<noscript>` iframe, for the body.
+ *
+ * In `'basic'` mode this is an empty string: the whole point of gating is that an unauthenticated
+ * `<noscript>` iframe would defeat it — a browser with JavaScript disabled cannot have granted
+ * anything, so there is nothing lawful left to render. `'advanced'` keeps the frame.
+ */
 export declare const gtmNoscriptFrame: (opts: GtmOptions) => string;
 /**
  * Load the container from script, for a host that cannot emit into its own head.
@@ -25,6 +54,94 @@ export declare const gtmNoscriptFrame: (opts: GtmOptions) => string;
  * The head snippet is strictly better and should be preferred; this exists for a single-page app
  * whose HTML is not ours to edit. It still pushes the defaults first, and it still refuses to load
  * a second time.
+ *
+ * In `'basic'` mode the container element is not appended until `trackingGranted` is true: either
+ * the stored record already grants it, or — since this runs after the bundle mounted, past the
+ * window the head snippet exists to close — a subscription to `consentStore` catches the first
+ * update where it becomes true and unsubscribes. `'advanced'` appends it immediately, as before.
  */
 export declare const loadGtm: (opts: GtmOptions) => void;
+/**
+ * Which loader an id takes: `gtm` is the Tag Manager container (`gtm.js`), `gtag` the Google tag
+ * (`gtag.js`) — Google Analytics 4 (`G-`), a Google tag (`GT-`), Google Ads (`AW-`) and
+ * Floodlight (`DC-`).
+ */
+export type GoogleTagKind = 'gtm' | 'gtag';
+/** Whether `id` is a Tag Manager container or Google tag id this package can load. */
+export declare const isGoogleTagId: (id: string) => boolean;
+/** The loader `id` takes, or `null` when it is not a loadable id at all. */
+export declare const googleTagKind: (id: string) => GoogleTagKind | null;
+export interface GoogleTagOptions extends ConsentOptions {
+    /** `GTM-…`, `G-…`, `GT-…`, `AW-…` or `DC-…` — see {@link isGoogleTagId}. */
+    id: string;
+    /**
+     * The queue name, when a page runs more than one tag. Consent Mode from `@owlmeans/consent` —
+     * the bootstrap AND the dialog's later updates — always speaks on `window.dataLayer`, so a tag
+     * given another queue never hears a consent command. Leave it unset on a consent-gated page.
+     */
+    dataLayerName?: string;
+    /** See {@link GOOGLE_TAG_DEFAULT_MODE}. Defaults to `GOOGLE_TAG_DEFAULT_MODE` (`'basic'`). */
+    mode?: GoogleTagMode;
+}
+/**
+ * The one inline `<head>` script for a Google tag of any kind: the consent bootstrap FIRST, then
+ * ads redaction, then the loader the id's prefix calls for — the Tag Manager container for `GTM-`,
+ * gtag.js with `js` and `config` for `G-`, `GT-`, `AW-` and `DC-`.
+ *
+ * The order is the rule {@link gtmHeadScript} exists for, and it holds for gtag.js just the same:
+ * a tag decides what it may do from the consent state present when it loads. The bootstrap
+ * declares everything denied and applies any stored decision in the same turn, so a returning
+ * visitor's tag starts granted and a new visitor's starts cookieless.
+ *
+ * An id that is not a loadable id ({@link isGoogleTagId}) yields the consent bootstrap alone — a
+ * page must never lose its consent defaults because someone mistyped a tag. The result is safe to
+ * place inline in HTML as-is: `</` and `<!--` inside any configured value are escaped.
+ *
+ * In `GOOGLE_TAG_DEFAULT_MODE` (`'basic'`) the loader itself — the last piece — is wrapped in
+ * `consentGateScript`: it runs immediately for a returning visitor whose stored record already
+ * grants a signal-bearing category, and otherwise waits for `@owlmeans/consent`'s `CONSENT_EVENT`
+ * before ever requesting the tag. The bootstrap and the redaction flags are unaffected and still
+ * run unconditionally — Consent Mode's OWN denied-by-default signals are declared either way, so a
+ * tag that later does load still starts from `ad_storage`/`analytics_storage` denied. Pass
+ * `mode: 'advanced'` for the original, unconditional load.
+ */
+export declare const googleTagHeadScript: (opts: GoogleTagOptions) => string;
+/**
+ * The hosts a page running a Google tag has to allow in `script-src`, `connect-src` and
+ * `img-src`, for Google Analytics 4, Tag Manager and Google Ads together.
+ *
+ * Taken from Google's CSP guide (developers.google.com/tag-platform/security/guides/csp) and
+ * folded into one list, because the platform adds one list to all three directives:
+ *
+ * - `*.googletagmanager.com` — gtm.js and gtag/js (`www.`), and their measurement pings;
+ * - `*.google-analytics.com` — GA4 collection (`region1.`, `www.`);
+ * - `*.g.doubleclick.net` — GA4 with Google signals and Ads (`stats.g.`, `googleads.g.`);
+ * - `ad.doubleclick.net` — Ads and Floodlight conversions;
+ * - `www.googleadservices.com` — the Ads conversion script;
+ * - `pagead2.googlesyndication.com` — Ads and GA4-with-ads pings;
+ * - `*.google.com` — `www.google.com` (the Ads script, consent-mode pings), `adservice.`, and the
+ *   `analytics.google.com` collection endpoints.
+ *
+ * Every entry is an `https://` scheme, an optional `*.` label and a dotted host — the only shape
+ * the publisher's CSP filter lets through — and there are few enough to stay inside its per-slot
+ * cap. Google's country domains (`google.<TLD>`) cannot be named in that shape and are left out:
+ * what is lost is a remarketing ping from visitors on those domains, never the tag itself.
+ */
+export declare const GOOGLE_TAG_CSP_SOURCES: readonly string[];
+/**
+ * The hosts a Google tag frames: Tag Manager's service-worker and preview frames, and the Ads
+ * remarketing frame. For `frame-src`, which otherwise stays `'none'`.
+ */
+export declare const GOOGLE_TAG_FRAME_SOURCES: readonly string[];
+/**
+ * What a Google tag discloses on the cookie policy, for `CookiePolicy`'s `services`.
+ *
+ * Read off the id's prefix, because that is all the page knows: `G-` is Google Analytics 4
+ * (`_ga`, and `_ga_<id without G->` which carries the session), `AW-` Google Ads, `DC-` Floodlight.
+ * A `GTM-` container and a `GT-` Google tag route to whatever their owner configured at Google,
+ * so both are disclosed as an analytics AND an advertising entry, worded as configured there —
+ * the policy may not claim less than the tag can do. An invalid id discloses nothing, matching
+ * {@link googleTagHeadScript}, which loads nothing for it.
+ */
+export declare const googleTagServices: (id: string) => ConsentService[];
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEvD,MAAM,WAAW,UAAW,SAAQ,cAAc;IAChD,wCAAwC;IACxC,EAAE,EAAE,MAAM,CAAA;IACV,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa,SAAU,UAAU,KAAG,MAWhD,CAAA;AAED,6CAA6C;AAC7C,eAAO,MAAM,gBAAgB,SAAU,UAAU,KAAG,MAEsB,CAAA;AAE1E;;;;;;GAMG;AACH,eAAO,MAAM,OAAO,SAAU,UAAU,KAAG,IAkB1C,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEvE,kGAAkG;AAClG,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,UAAU,CAAA;AAEhD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,aAAuB,CAAA;AAE7D,MAAM,WAAW,UAAW,SAAQ,cAAc;IAChD,wCAAwC;IACxC,EAAE,EAAE,MAAM,CAAA;IACV,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,8FAA8F;IAC9F,IAAI,CAAC,EAAE,aAAa,CAAA;CACrB;AAYD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,aAAa,SAAU,UAAU,KAAG,MAShD,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,SAAU,UAAU,KAAG,MAOnD,CAAA;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,OAAO,SAAU,UAAU,KAAG,IA0C1C,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,MAAM,CAAA;AAc1C,sFAAsF;AACtF,eAAO,MAAM,aAAa,OAAQ,MAAM,KAAG,OACO,CAAA;AAElD,4EAA4E;AAC5E,eAAO,MAAM,aAAa,OAAQ,MAAM,KAAG,aAAa,GAAG,IACS,CAAA;AAEpE,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,4EAA4E;IAC5E,EAAE,EAAE,MAAM,CAAA;IACV;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,8FAA8F;IAC9F,IAAI,CAAC,EAAE,aAAa,CAAA;CACrB;AAyDD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,mBAAmB,SAAU,gBAAgB,KAAG,MAe5D,CAAA;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAQlD,CAAA;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAGpD,CAAA;AAkBF;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,OAAQ,MAAM,KAAG,cAAc,EA8C5D,CAAA"}