@owlmeans/web-gtm 0.1.18-rc.32 → 0.1.18-rc.34

package/README.md

@@ -6,7 +6,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.40
+npx @owlmeans/agent-skills@^0.1.18-rc.48
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/web-gtm",
-  "version": "0.1.18-rc.32",
-  "generatedAt": "2026-09-25T21:19:37.947Z",
+  "version": "0.1.18-rc.34",
+  "generatedAt": "2026-10-05T08:32:19.091Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/web-gtm/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/web-gtm
 
 **Layer:** Web
-**Install:** `"@owlmeans/web-gtm": "^0.1.18-rc.32"` in `dependencies`
+**Install:** `"@owlmeans/web-gtm": "^0.1.18-rc.34"` in `dependencies`
 
 The tag half of the consent set. It emits **strings and data**, not components, and it holds no
 state — the decision lives in `@owlmeans/consent`, which this package reads through
@@ -165,6 +165,13 @@ page says so.
   **built-in tag templates** (GA4, Google Ads, Floodlight, Conversion Linker) and Community
   Gallery templates, which load from the allowed hosts.
 
+## Sending events
+
+This package emits the head snippet and decides when the loader may run; it has no event-push API. An
+application sends its own events through `@owlmeans/log` calls that carry an `analytics` option, and
+`@owlmeans/web-log`'s `gtmAnalyticsPlugin` pushes them onto `window.dataLayer` only while analytics
+consent is granted (`/web-log`).
+
 ## Disclosing it
 
 `googleTagServices(id)` returns what the cookie policy lists under each category, read off the

package/build/consts.d.ts

@@ -0,0 +1,43 @@
+import type { GoogleTagMode } from './types.js';
+/**
+ * The platform default for {@link GtmOptions.mode} / {@link GoogleTagOptions.mode}.
+ *
+ * One named constant so flipping it later is a one-line change.
+ *
+ * - `'basic'` withholds the loader until a signal-bearing category is granted — which holds back
+ *   Google's own IP receipt too, not only what a granted tag may then do with it.
+ * - `'advanced'` loads immediately with Consent Mode signals denied — today's only behavior, and
+ *   Google's own recommended default for its own conversion modeling.
+ *
+ * Default is `'basic'`: read it as the EU/DE worst-case reading of ePrivacy Art. 5(3) — no third
+ * party receives a connection before consent.
+ */
+export declare const GOOGLE_TAG_DEFAULT_MODE: GoogleTagMode;
+/**
+ * The hosts a page running a Google tag has to allow in `script-src`, `connect-src` and
+ * `img-src`, for Google Analytics 4, Tag Manager and Google Ads together.
+ *
+ * Taken from Google's CSP guide (developers.google.com/tag-platform/security/guides/csp) and
+ * folded into one list, because the platform adds one list to all three directives:
+ *
+ * - `*.googletagmanager.com` — gtm.js and gtag/js (`www.`), and their measurement pings;
+ * - `*.google-analytics.com` — GA4 collection (`region1.`, `www.`);
+ * - `*.g.doubleclick.net` — GA4 with Google signals and Ads (`stats.g.`, `googleads.g.`);
+ * - `ad.doubleclick.net` — Ads and Floodlight conversions;
+ * - `www.googleadservices.com` — the Ads conversion script;
+ * - `pagead2.googlesyndication.com` — Ads and GA4-with-ads pings;
+ * - `*.google.com` — `www.google.com` (the Ads script, consent-mode pings), `adservice.`, and the
+ *   `analytics.google.com` collection endpoints.
+ *
+ * Every entry is an `https://` scheme, an optional `*.` label and a dotted host — the only shape
+ * the publisher's CSP filter lets through — and there are few enough to stay inside its per-slot
+ * cap. Google's country domains (`google.<TLD>`) cannot be named in that shape and are left out:
+ * what is lost is a remarketing ping from visitors on those domains, never the tag itself.
+ */
+export declare const GOOGLE_TAG_CSP_SOURCES: readonly string[];
+/**
+ * The hosts a Google tag frames: Tag Manager's service-worker and preview frames, and the Ads
+ * remarketing frame. For `frame-src`, which otherwise stays `'none'`.
+ */
+export declare const GOOGLE_TAG_FRAME_SOURCES: readonly string[];
+//# sourceMappingURL=consts.d.ts.map

package/build/consts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,aAAuB,CAAA;AAE7D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAQlD,CAAA;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAGpD,CAAA"}

package/build/consts.js

@@ -0,0 +1,53 @@
+/**
+ * The platform default for {@link GtmOptions.mode} / {@link GoogleTagOptions.mode}.
+ *
+ * One named constant so flipping it later is a one-line change.
+ *
+ * - `'basic'` withholds the loader until a signal-bearing category is granted — which holds back
+ *   Google's own IP receipt too, not only what a granted tag may then do with it.
+ * - `'advanced'` loads immediately with Consent Mode signals denied — today's only behavior, and
+ *   Google's own recommended default for its own conversion modeling.
+ *
+ * Default is `'basic'`: read it as the EU/DE worst-case reading of ePrivacy Art. 5(3) — no third
+ * party receives a connection before consent.
+ */
+export const GOOGLE_TAG_DEFAULT_MODE = 'basic';
+/**
+ * The hosts a page running a Google tag has to allow in `script-src`, `connect-src` and
+ * `img-src`, for Google Analytics 4, Tag Manager and Google Ads together.
+ *
+ * Taken from Google's CSP guide (developers.google.com/tag-platform/security/guides/csp) and
+ * folded into one list, because the platform adds one list to all three directives:
+ *
+ * - `*.googletagmanager.com` — gtm.js and gtag/js (`www.`), and their measurement pings;
+ * - `*.google-analytics.com` — GA4 collection (`region1.`, `www.`);
+ * - `*.g.doubleclick.net` — GA4 with Google signals and Ads (`stats.g.`, `googleads.g.`);
+ * - `ad.doubleclick.net` — Ads and Floodlight conversions;
+ * - `www.googleadservices.com` — the Ads conversion script;
+ * - `pagead2.googlesyndication.com` — Ads and GA4-with-ads pings;
+ * - `*.google.com` — `www.google.com` (the Ads script, consent-mode pings), `adservice.`, and the
+ *   `analytics.google.com` collection endpoints.
+ *
+ * Every entry is an `https://` scheme, an optional `*.` label and a dotted host — the only shape
+ * the publisher's CSP filter lets through — and there are few enough to stay inside its per-slot
+ * cap. Google's country domains (`google.<TLD>`) cannot be named in that shape and are left out:
+ * what is lost is a remarketing ping from visitors on those domains, never the tag itself.
+ */
+export const GOOGLE_TAG_CSP_SOURCES = Object.freeze([
+    'https://*.googletagmanager.com',
+    'https://*.google-analytics.com',
+    'https://*.g.doubleclick.net',
+    'https://ad.doubleclick.net',
+    'https://www.googleadservices.com',
+    'https://pagead2.googlesyndication.com',
+    'https://*.google.com',
+]);
+/**
+ * The hosts a Google tag frames: Tag Manager's service-worker and preview frames, and the Ads
+ * remarketing frame. For `frame-src`, which otherwise stays `'none'`.
+ */
+export const GOOGLE_TAG_FRAME_SOURCES = Object.freeze([
+    'https://www.googletagmanager.com',
+    'https://td.doubleclick.net',
+]);
+//# sourceMappingURL=consts.js.map

package/build/consts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAkB,OAAO,CAAA;AAE7D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACrE,gCAAgC;IAChC,gCAAgC;IAChC,6BAA6B;IAC7B,4BAA4B;IAC5B,kCAAkC;IAClC,uCAAuC;IACvC,sBAAsB;CACvB,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACvE,kCAAkC;IAClC,4BAA4B;CAC7B,CAAC,CAAA"}

package/build/consts.local.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The id shapes Google issues today, and nothing else.
+ *
+ * Deliberately strict — upper case, a known prefix, a bounded run of letters and digits — because
+ * the id is typed by a person into a settings form and ends up inside an inline script and a
+ * script URL. A value this pattern accepts cannot carry a quote, a tag or a second parameter, so
+ * the check is what makes it safe to store, not only to emit. `UA-` is not here: Universal
+ * Analytics stopped processing data in 2024, and accepting its ids would promise measurement that
+ * never arrives.
+ */
+export declare const GOOGLE_TAG_ID: RegExp;
+/** A queue name has to be a plain identifier: it becomes `window[name]` in the emitted script. */
+export declare const JS_IDENTIFIER: RegExp;
+export declare const GOOGLE = "Google LLC";
+export declare const GOOGLE_PRIVACY = "https://policies.google.com/privacy";
+export declare const UNTIL_ANALYTICS: string;
+export declare const UNTIL_MARKETING: string;
+//# sourceMappingURL=consts.local.d.ts.map

package/build/consts.local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.local.d.ts","sourceRoot":"","sources":["../src/consts.local.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa,QAAuD,CAAA;AAEjF,kGAAkG;AAClG,eAAO,MAAM,aAAa,QAA+B,CAAA;AAEzD,eAAO,MAAM,MAAM,eAAe,CAAA;AAElC,eAAO,MAAM,cAAc,wCAAwC,CAAA;AAEnE,eAAO,MAAM,eAAe,QACS,CAAA;AAErC,eAAO,MAAM,eAAe,QACG,CAAA"}

package/build/consts.local.js

@@ -0,0 +1,20 @@
+/**
+ * The id shapes Google issues today, and nothing else.
+ *
+ * Deliberately strict — upper case, a known prefix, a bounded run of letters and digits — because
+ * the id is typed by a person into a settings form and ends up inside an inline script and a
+ * script URL. A value this pattern accepts cannot carry a quote, a tag or a second parameter, so
+ * the check is what makes it safe to store, not only to emit. `UA-` is not here: Universal
+ * Analytics stopped processing data in 2024, and accepting its ids would promise measurement that
+ * never arrives.
+ */
+export const GOOGLE_TAG_ID = /^(GTM-[A-Z0-9]{4,12}|(G|GT|AW|DC)-[A-Z0-9]{4,16})$/;
+/** A queue name has to be a plain identifier: it becomes `window[name]` in the emitted script. */
+export const JS_IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+export const GOOGLE = 'Google LLC';
+export const GOOGLE_PRIVACY = 'https://policies.google.com/privacy';
+export const UNTIL_ANALYTICS = 'Until analytics cookies are accepted it sets no cookies and sends only '
+    + 'cookieless measurement signals.';
+export const UNTIL_MARKETING = 'Until marketing cookies are accepted it sets no cookies and ad click '
+    + 'identifiers are redacted.';
+//# sourceMappingURL=consts.local.js.map

package/build/consts.local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.local.js","sourceRoot":"","sources":["../src/consts.local.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,oDAAoD,CAAA;AAEjF,kGAAkG;AAClG,MAAM,CAAC,MAAM,aAAa,GAAG,4BAA4B,CAAA;AAEzD,MAAM,CAAC,MAAM,MAAM,GAAG,YAAY,CAAA;AAElC,MAAM,CAAC,MAAM,cAAc,GAAG,qCAAqC,CAAA;AAEnE,MAAM,CAAC,MAAM,eAAe,GAAG,yEAAyE;MACpG,iCAAiC,CAAA;AAErC,MAAM,CAAC,MAAM,eAAe,GAAG,uEAAuE;MAClG,2BAA2B,CAAA"}

package/build/index.d.ts

@@ -1,28 +1,5 @@
-import type { ConsentOptions, ConsentService } from '@owlmeans/consent';
-/** `'gtm'` container / `'gtag'` — see {@link GtmOptions.mode} / {@link GoogleTagOptions.mode}. */
-export type GoogleTagMode = 'basic' | 'advanced';
-/**
- * The platform default for {@link GtmOptions.mode} / {@link GoogleTagOptions.mode}.
- *
- * One named constant so flipping it later is a one-line change.
- *
- * - `'basic'` withholds the loader until a signal-bearing category is granted — which holds back
- *   Google's own IP receipt too, not only what a granted tag may then do with it.
- * - `'advanced'` loads immediately with Consent Mode signals denied — today's only behavior, and
- *   Google's own recommended default for its own conversion modeling.
- *
- * Default is `'basic'`: read it as the EU/DE worst-case reading of ePrivacy Art. 5(3) — no third
- * party receives a connection before consent.
- */
-export declare const GOOGLE_TAG_DEFAULT_MODE: GoogleTagMode;
-export interface GtmOptions extends ConsentOptions {
-    /** Container id, e.g. `GTM-XXXXXXX`. */
-    id: string;
-    /** The queue name, when a page runs more than one container. */
-    dataLayerName?: string;
-    /** See {@link GOOGLE_TAG_DEFAULT_MODE}. Defaults to `GOOGLE_TAG_DEFAULT_MODE` (`'basic'`). */
-    mode?: GoogleTagMode;
-}
+import { type ConsentService } from '@owlmeans/consent';
+import type { GoogleTagKind, GoogleTagOptions, GtmOptions } from './types.js';
 /**
  * The inline `<head>` snippet, consent first and the container second.
  *
@@ -61,28 +38,10 @@ export declare const gtmNoscriptFrame: (opts: GtmOptions) => string;
  * update where it becomes true and unsubscribes. `'advanced'` appends it immediately, as before.
  */
 export declare const loadGtm: (opts: GtmOptions) => void;
-/**
- * Which loader an id takes: `gtm` is the Tag Manager container (`gtm.js`), `gtag` the Google tag
- * (`gtag.js`) — Google Analytics 4 (`G-`), a Google tag (`GT-`), Google Ads (`AW-`) and
- * Floodlight (`DC-`).
- */
-export type GoogleTagKind = 'gtm' | 'gtag';
 /** Whether `id` is a Tag Manager container or Google tag id this package can load. */
 export declare const isGoogleTagId: (id: string) => boolean;
 /** The loader `id` takes, or `null` when it is not a loadable id at all. */
 export declare const googleTagKind: (id: string) => GoogleTagKind | null;
-export interface GoogleTagOptions extends ConsentOptions {
-    /** `GTM-…`, `G-…`, `GT-…`, `AW-…` or `DC-…` — see {@link isGoogleTagId}. */
-    id: string;
-    /**
-     * The queue name, when a page runs more than one tag. Consent Mode from `@owlmeans/consent` —
-     * the bootstrap AND the dialog's later updates — always speaks on `window.dataLayer`, so a tag
-     * given another queue never hears a consent command. Leave it unset on a consent-gated page.
-     */
-    dataLayerName?: string;
-    /** See {@link GOOGLE_TAG_DEFAULT_MODE}. Defaults to `GOOGLE_TAG_DEFAULT_MODE` (`'basic'`). */
-    mode?: GoogleTagMode;
-}
 /**
  * The one inline `<head>` script for a Google tag of any kind: the consent bootstrap FIRST, then
  * ads redaction, then the loader the id's prefix calls for — the Tag Manager container for `GTM-`,
@@ -106,33 +65,6 @@ export interface GoogleTagOptions extends ConsentOptions {
  * `mode: 'advanced'` for the original, unconditional load.
  */
 export declare const googleTagHeadScript: (opts: GoogleTagOptions) => string;
-/**
- * The hosts a page running a Google tag has to allow in `script-src`, `connect-src` and
- * `img-src`, for Google Analytics 4, Tag Manager and Google Ads together.
- *
- * Taken from Google's CSP guide (developers.google.com/tag-platform/security/guides/csp) and
- * folded into one list, because the platform adds one list to all three directives:
- *
- * - `*.googletagmanager.com` — gtm.js and gtag/js (`www.`), and their measurement pings;
- * - `*.google-analytics.com` — GA4 collection (`region1.`, `www.`);
- * - `*.g.doubleclick.net` — GA4 with Google signals and Ads (`stats.g.`, `googleads.g.`);
- * - `ad.doubleclick.net` — Ads and Floodlight conversions;
- * - `www.googleadservices.com` — the Ads conversion script;
- * - `pagead2.googlesyndication.com` — Ads and GA4-with-ads pings;
- * - `*.google.com` — `www.google.com` (the Ads script, consent-mode pings), `adservice.`, and the
- *   `analytics.google.com` collection endpoints.
- *
- * Every entry is an `https://` scheme, an optional `*.` label and a dotted host — the only shape
- * the publisher's CSP filter lets through — and there are few enough to stay inside its per-slot
- * cap. Google's country domains (`google.<TLD>`) cannot be named in that shape and are left out:
- * what is lost is a remarketing ping from visitors on those domains, never the tag itself.
- */
-export declare const GOOGLE_TAG_CSP_SOURCES: readonly string[];
-/**
- * The hosts a Google tag frames: Tag Manager's service-worker and preview frames, and the Ads
- * remarketing frame. For `frame-src`, which otherwise stays `'none'`.
- */
-export declare const GOOGLE_TAG_FRAME_SOURCES: readonly string[];
 /**
  * What a Google tag discloses on the cookie policy, for `CookiePolicy`'s `services`.
  *
@@ -144,4 +76,6 @@ export declare const GOOGLE_TAG_FRAME_SOURCES: readonly string[];
  * {@link googleTagHeadScript}, which loads nothing for it.
  */
 export declare const googleTagServices: (id: string) => ConsentService[];
+export type { GoogleTagKind, GoogleTagMode, GoogleTagOptions, GtmOptions } from './types.js';
+export { GOOGLE_TAG_CSP_SOURCES, GOOGLE_TAG_DEFAULT_MODE, GOOGLE_TAG_FRAME_SOURCES } from './consts.js';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEvE,kGAAkG;AAClG,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,UAAU,CAAA;AAEhD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,aAAuB,CAAA;AAE7D,MAAM,WAAW,UAAW,SAAQ,cAAc;IAChD,wCAAwC;IACxC,EAAE,EAAE,MAAM,CAAA;IACV,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,8FAA8F;IAC9F,IAAI,CAAC,EAAE,aAAa,CAAA;CACrB;AAYD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,aAAa,SAAU,UAAU,KAAG,MAShD,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,SAAU,UAAU,KAAG,MAOnD,CAAA;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,OAAO,SAAU,UAAU,KAAG,IA0C1C,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,MAAM,CAAA;AAc1C,sFAAsF;AACtF,eAAO,MAAM,aAAa,OAAQ,MAAM,KAAG,OACO,CAAA;AAElD,4EAA4E;AAC5E,eAAO,MAAM,aAAa,OAAQ,MAAM,KAAG,aAAa,GAAG,IACS,CAAA;AAEpE,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,4EAA4E;IAC5E,EAAE,EAAE,MAAM,CAAA;IACV;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,8FAA8F;IAC9F,IAAI,CAAC,EAAE,aAAa,CAAA;CACrB;AAyDD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,mBAAmB,SAAU,gBAAgB,KAAG,MAe5D,CAAA;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAQlD,CAAA;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAGpD,CAAA;AAkBF;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,OAAQ,MAAM,KAAG,cAAc,EA8C5D,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkH,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAGvK,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAY7E;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,aAAa,SAAU,UAAU,KAAG,MAShD,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,SAAU,UAAU,KAAG,MAOnD,CAAA;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,OAAO,SAAU,UAAU,KAAG,IA0C1C,CAAA;AAED,sFAAsF;AACtF,eAAO,MAAM,aAAa,OAAQ,MAAM,KAAG,OACO,CAAA;AAElD,4EAA4E;AAC5E,eAAO,MAAM,aAAa,OAAQ,MAAM,KAAG,aAAa,GAAG,IACS,CAAA;AAsDpE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,mBAAmB,SAAU,gBAAgB,KAAG,MAe5D,CAAA;AAYD;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,OAAQ,MAAM,KAAG,cAAc,EA8C5D,CAAA;AAED,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAC5F,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA"}

package/build/index.js

@@ -1,18 +1,6 @@
-import { CONSENT_ANALYTICS, CONSENT_MARKETING, consentBootstrapScript, consentGateScript, consentStore, trackingGranted, } from '@owlmeans/consent';
-/**
- * The platform default for {@link GtmOptions.mode} / {@link GoogleTagOptions.mode}.
- *
- * One named constant so flipping it later is a one-line change.
- *
- * - `'basic'` withholds the loader until a signal-bearing category is granted — which holds back
- *   Google's own IP receipt too, not only what a granted tag may then do with it.
- * - `'advanced'` loads immediately with Consent Mode signals denied — today's only behavior, and
- *   Google's own recommended default for its own conversion modeling.
- *
- * Default is `'basic'`: read it as the EU/DE worst-case reading of ePrivacy Art. 5(3) — no third
- * party receives a connection before consent.
- */
-export const GOOGLE_TAG_DEFAULT_MODE = 'basic';
+import { CONSENT_ANALYTICS, CONSENT_MARKETING, consentBootstrapScript, consentGateScript, consentStore, trackingGranted } from '@owlmeans/consent';
+import { GOOGLE, GOOGLE_PRIVACY, GOOGLE_TAG_ID, JS_IDENTIFIER, UNTIL_ANALYTICS, UNTIL_MARKETING } from './consts.local.js';
+import { GOOGLE_TAG_DEFAULT_MODE } from './consts.js';
 /** Google's own container IIFE, the id and queue name injected as JSON data. */
 const gtmContainerScript = (layer, id) => `(function(w,d,s,l,i){w[l]=w[l]||[];` +
     `w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});` +
@@ -108,23 +96,10 @@ export const loadGtm = (opts) => {
         }
     });
 };
-/**
- * The id shapes Google issues today, and nothing else.
- *
- * Deliberately strict — upper case, a known prefix, a bounded run of letters and digits — because
- * the id is typed by a person into a settings form and ends up inside an inline script and a
- * script URL. A value this pattern accepts cannot carry a quote, a tag or a second parameter, so
- * the check is what makes it safe to store, not only to emit. `UA-` is not here: Universal
- * Analytics stopped processing data in 2024, and accepting its ids would promise measurement that
- * never arrives.
- */
-const GOOGLE_TAG_ID = /^(GTM-[A-Z0-9]{4,12}|(G|GT|AW|DC)-[A-Z0-9]{4,16})$/;
 /** Whether `id` is a Tag Manager container or Google tag id this package can load. */
 export const isGoogleTagId = (id) => typeof id === 'string' && GOOGLE_TAG_ID.test(id);
 /** The loader `id` takes, or `null` when it is not a loadable id at all. */
 export const googleTagKind = (id) => !isGoogleTagId(id) ? null : id.startsWith('GTM-') ? 'gtm' : 'gtag';
-/** A queue name has to be a plain identifier: it becomes `window[name]` in the emitted script. */
-const JS_IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
 const layerOf = (opts) => opts.dataLayerName != null && JS_IDENTIFIER.test(opts.dataLayerName)
     ? opts.dataLayerName
     : 'dataLayer';
@@ -205,56 +180,12 @@ export const googleTagHeadScript = (opts) => {
     }
     return inlineSafe(`${bootstrap};${redaction};${loader}`);
 };
-/**
- * The hosts a page running a Google tag has to allow in `script-src`, `connect-src` and
- * `img-src`, for Google Analytics 4, Tag Manager and Google Ads together.
- *
- * Taken from Google's CSP guide (developers.google.com/tag-platform/security/guides/csp) and
- * folded into one list, because the platform adds one list to all three directives:
- *
- * - `*.googletagmanager.com` — gtm.js and gtag/js (`www.`), and their measurement pings;
- * - `*.google-analytics.com` — GA4 collection (`region1.`, `www.`);
- * - `*.g.doubleclick.net` — GA4 with Google signals and Ads (`stats.g.`, `googleads.g.`);
- * - `ad.doubleclick.net` — Ads and Floodlight conversions;
- * - `www.googleadservices.com` — the Ads conversion script;
- * - `pagead2.googlesyndication.com` — Ads and GA4-with-ads pings;
- * - `*.google.com` — `www.google.com` (the Ads script, consent-mode pings), `adservice.`, and the
- *   `analytics.google.com` collection endpoints.
- *
- * Every entry is an `https://` scheme, an optional `*.` label and a dotted host — the only shape
- * the publisher's CSP filter lets through — and there are few enough to stay inside its per-slot
- * cap. Google's country domains (`google.<TLD>`) cannot be named in that shape and are left out:
- * what is lost is a remarketing ping from visitors on those domains, never the tag itself.
- */
-export const GOOGLE_TAG_CSP_SOURCES = Object.freeze([
-    'https://*.googletagmanager.com',
-    'https://*.google-analytics.com',
-    'https://*.g.doubleclick.net',
-    'https://ad.doubleclick.net',
-    'https://www.googleadservices.com',
-    'https://pagead2.googlesyndication.com',
-    'https://*.google.com',
-]);
-/**
- * The hosts a Google tag frames: Tag Manager's service-worker and preview frames, and the Ads
- * remarketing frame. For `frame-src`, which otherwise stays `'none'`.
- */
-export const GOOGLE_TAG_FRAME_SOURCES = Object.freeze([
-    'https://www.googletagmanager.com',
-    'https://td.doubleclick.net',
-]);
-const GOOGLE = 'Google LLC';
-const GOOGLE_PRIVACY = 'https://policies.google.com/privacy';
 const analyticsService = (name, purpose, cookies) => ({
     name, provider: GOOGLE, category: CONSENT_ANALYTICS, purpose, cookies, privacyHref: GOOGLE_PRIVACY,
 });
 const adsService = (name, purpose, cookies) => ({
     name, provider: GOOGLE, category: CONSENT_MARKETING, purpose, cookies, privacyHref: GOOGLE_PRIVACY,
 });
-const UNTIL_ANALYTICS = 'Until analytics cookies are accepted it sets no cookies and sends only '
-    + 'cookieless measurement signals.';
-const UNTIL_MARKETING = 'Until marketing cookies are accepted it sets no cookies and ad click '
-    + 'identifiers are redacted.';
 /**
  * What a Google tag discloses on the cookie policy, for `CookiePolicy`'s `services`.
  *
@@ -291,4 +222,5 @@ export const googleTagServices = (id) => {
         }
     }
 };
+export { GOOGLE_TAG_CSP_SOURCES, GOOGLE_TAG_DEFAULT_MODE, GOOGLE_TAG_FRAME_SOURCES } from './consts.js';
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,YAAY,EAC7F,eAAe,GAChB,MAAM,mBAAmB,CAAA;AAM1B;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAkB,OAAO,CAAA;AAW7D,gFAAgF;AAChF,MAAM,kBAAkB,GAAG,CAAC,KAAa,EAAE,EAAU,EAAU,EAAE,CAC/D,qCAAqC;IACrC,+DAA+D;IAC/D,0DAA0D;IAC1D,4CAA4C;IAC5C,2DAA2D;IAC3D,kCAAkC;IAClC,6BAA6B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,CAAA;AAE7E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAgB,EAAU,EAAE;IACxD,MAAM,SAAS,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAA;IAC9C,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,aAAa,IAAI,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;IAE7E,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,uBAAuB,CAAC,KAAK,OAAO,EAAE,CAAC;QACvD,OAAO,GAAG,SAAS,IAAI,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAA;IAC1D,CAAC;IAED,OAAO,GAAG,SAAS,IAAI,MAAM,EAAE,CAAA;AACjC,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAgB,EAAU,EAAE;IAC3D,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,uBAAuB,CAAC,KAAK,OAAO,EAAE,CAAC;QACvD,OAAO,EAAE,CAAA;IACX,CAAC;IAED,OAAO,4DAA4D,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG;QAC/F,wEAAwE,CAAA;AAC5E,CAAC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAgB,EAAQ,EAAE;IAChD,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE,CAAC;QACpC,OAAM;IACR,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,IAAI,CAAC,EAAE,EAAE,CAAA;IACnC,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QAC5C,OAAM;IACR,CAAC;IACD,6FAA6F;IAC7F,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEvB,MAAM,MAAM,GAAG,GAAS,EAAE;QACxB,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YAC5C,OAAM;QACR,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,IAAI,WAAW,CAAA;QAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAA;QAC/C,MAAM,CAAC,EAAE,GAAG,MAAM,CAAA;QAClB,MAAM,CAAC,KAAK,GAAG,IAAI,CAAA;QACnB,MAAM,CAAC,GAAG,GAAG,8CAA8C,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;cACpF,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACpE,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;IACnC,CAAC,CAAA;IAED,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,uBAAuB,CAAC,KAAK,OAAO,EAAE,CAAC;QACvD,MAAM,EAAE,CAAA;QAER,OAAM;IACR,CAAC;IAED,IAAI,eAAe,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAChE,MAAM,EAAE,CAAA;QAER,OAAM;IACR,CAAC;IAED,MAAM,WAAW,GAAG,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;QACjD,IAAI,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACnD,WAAW,EAAE,CAAA;YACb,MAAM,EAAE,CAAA;QACV,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AASD;;;;;;;;;GASG;AACH,MAAM,aAAa,GAAG,oDAAoD,CAAA;AAE1E,sFAAsF;AACtF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,EAAU,EAAW,EAAE,CACnD,OAAO,EAAE,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAElD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,EAAU,EAAwB,EAAE,CAChE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;AAepE,kGAAkG;AAClG,MAAM,aAAa,GAAG,4BAA4B,CAAA;AAElD,MAAM,OAAO,GAAG,CAAC,IAAsB,EAAU,EAAE,CACjD,IAAI,CAAC,aAAa,IAAI,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;IAClE,CAAC,CAAC,IAAI,CAAC,aAAa;IACpB,CAAC,CAAC,WAAW,CAAA;AAEjB;;;;;;;;GAQG;AACH,MAAM,UAAU,GAAG,CAAC,MAAc,EAAU,EAAE,CAC5C,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;AAE3D;;;;;;;;GAQG;AACH,MAAM,eAAe,GAAG,CAAC,KAAa,EAAU,EAAE,CAChD,iEAAiE;IACjE,uEAAuE;IACvE,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAA;AAErC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,EAAU,EAAU,EAAE,CACvD,uEAAuE;IACvE,sEAAsE;IACtE,mCAAmC;IACnC,sDAAsD;IACtD,4EAA4E;IAC5E,mDAAmD;IACnD,8CAA8C;IAC9C,oBAAoB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,CAAA;AAEpE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,IAAsB,EAAU,EAAE;IACpE,MAAM,SAAS,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAA;IAC9C,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACnC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACjB,OAAO,UAAU,CAAC,SAAS,CAAC,CAAA;IAC9B,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3B,MAAM,MAAM,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;IAC/F,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IAExC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,uBAAuB,CAAC,KAAK,OAAO,EAAE,CAAC;QACvD,OAAO,UAAU,CAAC,GAAG,SAAS,IAAI,SAAS,IAAI,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;IACnF,CAAC;IAED,OAAO,UAAU,CAAC,GAAG,SAAS,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC,CAAA;AAC1D,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACrE,gCAAgC;IAChC,gCAAgC;IAChC,6BAA6B;IAC7B,4BAA4B;IAC5B,kCAAkC;IAClC,uCAAuC;IACvC,sBAAsB;CACvB,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACvE,kCAAkC;IAClC,4BAA4B;CAC7B,CAAC,CAAA;AAEF,MAAM,MAAM,GAAG,YAAY,CAAA;AAC3B,MAAM,cAAc,GAAG,qCAAqC,CAAA;AAE5D,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,OAAiB,EAAkB,EAAE,CAAC,CAAC;IAC9F,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc;CACnG,CAAC,CAAA;AAEF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,OAAiB,EAAkB,EAAE,CAAC,CAAC;IACxF,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc;CACnG,CAAC,CAAA;AAEF,MAAM,eAAe,GAAG,yEAAyE;MAC7F,iCAAiC,CAAA;AACrC,MAAM,eAAe,GAAG,uEAAuE;MAC3F,2BAA2B,CAAA;AAE/B;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,EAAU,EAAoB,EAAE;IAChE,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;IAC3C,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,GAAG;YACN,OAAO,CAAC,gBAAgB,CACtB,kBAAkB,EAClB,wFAAwF;sBACpF,qCAAqC,eAAe,EAAE,EAC1D,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAC9B,CAAC,CAAA;QACJ,KAAK,IAAI;YACP,OAAO,CAAC,UAAU,CAChB,YAAY,EACZ,wFAAwF;sBACpF,+BAA+B,eAAe,EAAE,EACpD,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC,CAAA;QACJ,KAAK,IAAI;YACP,OAAO,CAAC,UAAU,CAChB,0CAA0C,EAC1C,4DAA4D,eAAe,EAAE,EAC7E,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC,CAAA;QACJ,SAAS,CAAC;YACR,MAAM,MAAM,GAAG,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,YAAY,CAAA;YACrE,MAAM,KAAK,GAAG,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAA;YAExE,OAAO;gBACL,gBAAgB,CACd,GAAG,MAAM,cAAc,EACvB,sCAAsC,KAAK,gCAAgC;sBACvE,eAAe,EACnB,CAAC,KAAK,EAAE,OAAO,CAAC,CACjB;gBACD,UAAU,CACR,GAAG,MAAM,gBAAgB,EACzB,wCAAwC,KAAK,oCAAoC;sBAC7E,6BAA6B,eAAe,EAAE,EAClD,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB;aACF,CAAA;QACH,CAAC;IACH,CAAC;AACH,CAAC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAuB,MAAM,mBAAmB,CAAA;AACvK,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAC1H,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAGrD,gFAAgF;AAChF,MAAM,kBAAkB,GAAG,CAAC,KAAa,EAAE,EAAU,EAAU,EAAE,CAC/D,qCAAqC;IACrC,+DAA+D;IAC/D,0DAA0D;IAC1D,4CAA4C;IAC5C,2DAA2D;IAC3D,kCAAkC;IAClC,6BAA6B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,CAAA;AAE7E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAgB,EAAU,EAAE;IACxD,MAAM,SAAS,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAA;IAC9C,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,aAAa,IAAI,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;IAE7E,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,uBAAuB,CAAC,KAAK,OAAO,EAAE,CAAC;QACvD,OAAO,GAAG,SAAS,IAAI,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAA;IAC1D,CAAC;IAED,OAAO,GAAG,SAAS,IAAI,MAAM,EAAE,CAAA;AACjC,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAgB,EAAU,EAAE;IAC3D,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,uBAAuB,CAAC,KAAK,OAAO,EAAE,CAAC;QACvD,OAAO,EAAE,CAAA;IACX,CAAC;IAED,OAAO,4DAA4D,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG;QAC/F,wEAAwE,CAAA;AAC5E,CAAC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAgB,EAAQ,EAAE;IAChD,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE,CAAC;QACpC,OAAM;IACR,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,IAAI,CAAC,EAAE,EAAE,CAAA;IACnC,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QAC5C,OAAM;IACR,CAAC;IACD,6FAA6F;IAC7F,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEvB,MAAM,MAAM,GAAG,GAAS,EAAE;QACxB,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YAC5C,OAAM;QACR,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,IAAI,WAAW,CAAA;QAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAA;QAC/C,MAAM,CAAC,EAAE,GAAG,MAAM,CAAA;QAClB,MAAM,CAAC,KAAK,GAAG,IAAI,CAAA;QACnB,MAAM,CAAC,GAAG,GAAG,8CAA8C,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;cACpF,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACpE,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;IACnC,CAAC,CAAA;IAED,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,uBAAuB,CAAC,KAAK,OAAO,EAAE,CAAC;QACvD,MAAM,EAAE,CAAA;QAER,OAAM;IACR,CAAC;IAED,IAAI,eAAe,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAChE,MAAM,EAAE,CAAA;QAER,OAAM;IACR,CAAC;IAED,MAAM,WAAW,GAAG,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;QACjD,IAAI,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACnD,WAAW,EAAE,CAAA;YACb,MAAM,EAAE,CAAA;QACV,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,sFAAsF;AACtF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,EAAU,EAAW,EAAE,CACnD,OAAO,EAAE,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAElD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,EAAU,EAAwB,EAAE,CAChE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;AAEpE,MAAM,OAAO,GAAG,CAAC,IAAsB,EAAU,EAAE,CACjD,IAAI,CAAC,aAAa,IAAI,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;IAClE,CAAC,CAAC,IAAI,CAAC,aAAa;IACpB,CAAC,CAAC,WAAW,CAAA;AAEjB;;;;;;;;GAQG;AACH,MAAM,UAAU,GAAG,CAAC,MAAc,EAAU,EAAE,CAC5C,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;AAE3D;;;;;;;;GAQG;AACH,MAAM,eAAe,GAAG,CAAC,KAAa,EAAU,EAAE,CAChD,iEAAiE;IACjE,uEAAuE;IACvE,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAA;AAErC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,EAAU,EAAU,EAAE,CACvD,uEAAuE;IACvE,sEAAsE;IACtE,mCAAmC;IACnC,sDAAsD;IACtD,4EAA4E;IAC5E,mDAAmD;IACnD,8CAA8C;IAC9C,oBAAoB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,CAAA;AAEpE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,IAAsB,EAAU,EAAE;IACpE,MAAM,SAAS,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAA;IAC9C,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACnC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACjB,OAAO,UAAU,CAAC,SAAS,CAAC,CAAA;IAC9B,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3B,MAAM,MAAM,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;IAC/F,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IAExC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,uBAAuB,CAAC,KAAK,OAAO,EAAE,CAAC;QACvD,OAAO,UAAU,CAAC,GAAG,SAAS,IAAI,SAAS,IAAI,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;IACnF,CAAC;IAED,OAAO,UAAU,CAAC,GAAG,SAAS,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC,CAAA;AAC1D,CAAC,CAAA;AAGD,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,OAAiB,EAAkB,EAAE,CAAC,CAAC;IAC9F,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc;CACnG,CAAC,CAAA;AAEF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,OAAiB,EAAkB,EAAE,CAAC,CAAC;IACxF,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc;CACnG,CAAC,CAAA;AAGF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,EAAU,EAAoB,EAAE;IAChE,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;IAC3C,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,GAAG;YACN,OAAO,CAAC,gBAAgB,CACtB,kBAAkB,EAClB,wFAAwF;sBACpF,qCAAqC,eAAe,EAAE,EAC1D,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAC9B,CAAC,CAAA;QACJ,KAAK,IAAI;YACP,OAAO,CAAC,UAAU,CAChB,YAAY,EACZ,wFAAwF;sBACpF,+BAA+B,eAAe,EAAE,EACpD,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC,CAAA;QACJ,KAAK,IAAI;YACP,OAAO,CAAC,UAAU,CAChB,0CAA0C,EAC1C,4DAA4D,eAAe,EAAE,EAC7E,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC,CAAA;QACJ,SAAS,CAAC;YACR,MAAM,MAAM,GAAG,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,YAAY,CAAA;YACrE,MAAM,KAAK,GAAG,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAA;YAExE,OAAO;gBACL,gBAAgB,CACd,GAAG,MAAM,cAAc,EACvB,sCAAsC,KAAK,gCAAgC;sBACvE,eAAe,EACnB,CAAC,KAAK,EAAE,OAAO,CAAC,CACjB;gBACD,UAAU,CACR,GAAG,MAAM,gBAAgB,EACzB,wCAAwC,KAAK,oCAAoC;sBAC7E,6BAA6B,eAAe,EAAE,EAClD,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB;aACF,CAAA;QACH,CAAC;IACH,CAAC;AACH,CAAC,CAAA;AAGD,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA"}

package/build/types.d.ts

@@ -0,0 +1,30 @@
+import type { ConsentOptions } from '@owlmeans/consent';
+/** `'gtm'` container / `'gtag'` — see {@link GtmOptions.mode} / {@link GoogleTagOptions.mode}. */
+export type GoogleTagMode = 'basic' | 'advanced';
+export interface GtmOptions extends ConsentOptions {
+    /** Container id, e.g. `GTM-XXXXXXX`. */
+    id: string;
+    /** The queue name, when a page runs more than one container. */
+    dataLayerName?: string;
+    /** See {@link GOOGLE_TAG_DEFAULT_MODE}. Defaults to `GOOGLE_TAG_DEFAULT_MODE` (`'basic'`). */
+    mode?: GoogleTagMode;
+}
+/**
+ * Which loader an id takes: `gtm` is the Tag Manager container (`gtm.js`), `gtag` the Google tag
+ * (`gtag.js`) — Google Analytics 4 (`G-`), a Google tag (`GT-`), Google Ads (`AW-`) and
+ * Floodlight (`DC-`).
+ */
+export type GoogleTagKind = 'gtm' | 'gtag';
+export interface GoogleTagOptions extends ConsentOptions {
+    /** `GTM-…`, `G-…`, `GT-…`, `AW-…` or `DC-…` — see {@link isGoogleTagId}. */
+    id: string;
+    /**
+     * The queue name, when a page runs more than one tag. Consent Mode from `@owlmeans/consent` —
+     * the bootstrap AND the dialog's later updates — always speaks on `window.dataLayer`, so a tag
+     * given another queue never hears a consent command. Leave it unset on a consent-gated page.
+     */
+    dataLayerName?: string;
+    /** See {@link GOOGLE_TAG_DEFAULT_MODE}. Defaults to `GOOGLE_TAG_DEFAULT_MODE` (`'basic'`). */
+    mode?: GoogleTagMode;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEvD,kGAAkG;AAClG,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,UAAU,CAAA;AAEhD,MAAM,WAAW,UAAW,SAAQ,cAAc;IAChD,wCAAwC;IACxC,EAAE,EAAE,MAAM,CAAA;IACV,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,8FAA8F;IAC9F,IAAI,CAAC,EAAE,aAAa,CAAA;CACrB;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,MAAM,CAAA;AAE1C,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,4EAA4E;IAC5E,EAAE,EAAE,MAAM,CAAA;IACV;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,8FAA8F;IAC9F,IAAI,CAAC,EAAE,aAAa,CAAA;CACrB"}

package/build/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/web-gtm",
-  "version": "0.1.18-rc.32",
+  "version": "0.1.18-rc.34",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -22,11 +22,11 @@
     }
   },
   "dependencies": {
-    "@owlmeans/consent": "^0.1.18-rc.9"
+    "@owlmeans/consent": "^0.1.18-rc.10"
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@types/bun": "^1.4.0",
+    "@types/bun": "^1.4.2",
     "nodemon": "^3.1.14",
     "typescript": "^7.0.2"
   },

package/src/consts.local.ts

@@ -0,0 +1,24 @@
+/**
+ * The id shapes Google issues today, and nothing else.
+ *
+ * Deliberately strict — upper case, a known prefix, a bounded run of letters and digits — because
+ * the id is typed by a person into a settings form and ends up inside an inline script and a
+ * script URL. A value this pattern accepts cannot carry a quote, a tag or a second parameter, so
+ * the check is what makes it safe to store, not only to emit. `UA-` is not here: Universal
+ * Analytics stopped processing data in 2024, and accepting its ids would promise measurement that
+ * never arrives.
+ */
+export const GOOGLE_TAG_ID = /^(GTM-[A-Z0-9]{4,12}|(G|GT|AW|DC)-[A-Z0-9]{4,16})$/
+
+/** A queue name has to be a plain identifier: it becomes `window[name]` in the emitted script. */
+export const JS_IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/
+
+export const GOOGLE = 'Google LLC'
+
+export const GOOGLE_PRIVACY = 'https://policies.google.com/privacy'
+
+export const UNTIL_ANALYTICS = 'Until analytics cookies are accepted it sets no cookies and sends only '
+  + 'cookieless measurement signals.'
+
+export const UNTIL_MARKETING = 'Until marketing cookies are accepted it sets no cookies and ad click '
+  + 'identifiers are redacted.'

package/src/consts.ts

@@ -0,0 +1,56 @@
+import type { GoogleTagMode } from './types.js'
+
+/**
+ * The platform default for {@link GtmOptions.mode} / {@link GoogleTagOptions.mode}.
+ *
+ * One named constant so flipping it later is a one-line change.
+ *
+ * - `'basic'` withholds the loader until a signal-bearing category is granted — which holds back
+ *   Google's own IP receipt too, not only what a granted tag may then do with it.
+ * - `'advanced'` loads immediately with Consent Mode signals denied — today's only behavior, and
+ *   Google's own recommended default for its own conversion modeling.
+ *
+ * Default is `'basic'`: read it as the EU/DE worst-case reading of ePrivacy Art. 5(3) — no third
+ * party receives a connection before consent.
+ */
+export const GOOGLE_TAG_DEFAULT_MODE: GoogleTagMode = 'basic'
+
+/**
+ * The hosts a page running a Google tag has to allow in `script-src`, `connect-src` and
+ * `img-src`, for Google Analytics 4, Tag Manager and Google Ads together.
+ *
+ * Taken from Google's CSP guide (developers.google.com/tag-platform/security/guides/csp) and
+ * folded into one list, because the platform adds one list to all three directives:
+ *
+ * - `*.googletagmanager.com` — gtm.js and gtag/js (`www.`), and their measurement pings;
+ * - `*.google-analytics.com` — GA4 collection (`region1.`, `www.`);
+ * - `*.g.doubleclick.net` — GA4 with Google signals and Ads (`stats.g.`, `googleads.g.`);
+ * - `ad.doubleclick.net` — Ads and Floodlight conversions;
+ * - `www.googleadservices.com` — the Ads conversion script;
+ * - `pagead2.googlesyndication.com` — Ads and GA4-with-ads pings;
+ * - `*.google.com` — `www.google.com` (the Ads script, consent-mode pings), `adservice.`, and the
+ *   `analytics.google.com` collection endpoints.
+ *
+ * Every entry is an `https://` scheme, an optional `*.` label and a dotted host — the only shape
+ * the publisher's CSP filter lets through — and there are few enough to stay inside its per-slot
+ * cap. Google's country domains (`google.<TLD>`) cannot be named in that shape and are left out:
+ * what is lost is a remarketing ping from visitors on those domains, never the tag itself.
+ */
+export const GOOGLE_TAG_CSP_SOURCES: readonly string[] = Object.freeze([
+  'https://*.googletagmanager.com',
+  'https://*.google-analytics.com',
+  'https://*.g.doubleclick.net',
+  'https://ad.doubleclick.net',
+  'https://www.googleadservices.com',
+  'https://pagead2.googlesyndication.com',
+  'https://*.google.com',
+])
+
+/**
+ * The hosts a Google tag frames: Tag Manager's service-worker and preview frames, and the Ads
+ * remarketing frame. For `frame-src`, which otherwise stays `'none'`.
+ */
+export const GOOGLE_TAG_FRAME_SOURCES: readonly string[] = Object.freeze([
+  'https://www.googletagmanager.com',
+  'https://td.doubleclick.net',
+])

package/src/index.ts

@@ -1,35 +1,7 @@
-import {
-  CONSENT_ANALYTICS, CONSENT_MARKETING, consentBootstrapScript, consentGateScript, consentStore,
-  trackingGranted,
-} from '@owlmeans/consent'
-import type { ConsentOptions, ConsentService } from '@owlmeans/consent'
-
-/** `'gtm'` container / `'gtag'` — see {@link GtmOptions.mode} / {@link GoogleTagOptions.mode}. */
-export type GoogleTagMode = 'basic' | 'advanced'
-
-/**
- * The platform default for {@link GtmOptions.mode} / {@link GoogleTagOptions.mode}.
- *
- * One named constant so flipping it later is a one-line change.
- *
- * - `'basic'` withholds the loader until a signal-bearing category is granted — which holds back
- *   Google's own IP receipt too, not only what a granted tag may then do with it.
- * - `'advanced'` loads immediately with Consent Mode signals denied — today's only behavior, and
- *   Google's own recommended default for its own conversion modeling.
- *
- * Default is `'basic'`: read it as the EU/DE worst-case reading of ePrivacy Art. 5(3) — no third
- * party receives a connection before consent.
- */
-export const GOOGLE_TAG_DEFAULT_MODE: GoogleTagMode = 'basic'
-
-export interface GtmOptions extends ConsentOptions {
-  /** Container id, e.g. `GTM-XXXXXXX`. */
-  id: string
-  /** The queue name, when a page runs more than one container. */
-  dataLayerName?: string
-  /** See {@link GOOGLE_TAG_DEFAULT_MODE}. Defaults to `GOOGLE_TAG_DEFAULT_MODE` (`'basic'`). */
-  mode?: GoogleTagMode
-}
+import { CONSENT_ANALYTICS, CONSENT_MARKETING, consentBootstrapScript, consentGateScript, consentStore, trackingGranted, type ConsentService } from '@owlmeans/consent'
+import { GOOGLE, GOOGLE_PRIVACY, GOOGLE_TAG_ID, JS_IDENTIFIER, UNTIL_ANALYTICS, UNTIL_MARKETING } from './consts.local.js'
+import { GOOGLE_TAG_DEFAULT_MODE } from './consts.js'
+import type { GoogleTagKind, GoogleTagOptions, GtmOptions } from './types.js'
 
 /** Google's own container IIFE, the id and queue name injected as JSON data. */
 const gtmContainerScript = (layer: string, id: string): string =>
@@ -140,25 +112,6 @@ export const loadGtm = (opts: GtmOptions): void => {
   })
 }
 
-/**
- * Which loader an id takes: `gtm` is the Tag Manager container (`gtm.js`), `gtag` the Google tag
- * (`gtag.js`) — Google Analytics 4 (`G-`), a Google tag (`GT-`), Google Ads (`AW-`) and
- * Floodlight (`DC-`).
- */
-export type GoogleTagKind = 'gtm' | 'gtag'
-
-/**
- * The id shapes Google issues today, and nothing else.
- *
- * Deliberately strict — upper case, a known prefix, a bounded run of letters and digits — because
- * the id is typed by a person into a settings form and ends up inside an inline script and a
- * script URL. A value this pattern accepts cannot carry a quote, a tag or a second parameter, so
- * the check is what makes it safe to store, not only to emit. `UA-` is not here: Universal
- * Analytics stopped processing data in 2024, and accepting its ids would promise measurement that
- * never arrives.
- */
-const GOOGLE_TAG_ID = /^(GTM-[A-Z0-9]{4,12}|(G|GT|AW|DC)-[A-Z0-9]{4,16})$/
-
 /** Whether `id` is a Tag Manager container or Google tag id this package can load. */
 export const isGoogleTagId = (id: string): boolean =>
   typeof id === 'string' && GOOGLE_TAG_ID.test(id)
@@ -167,22 +120,6 @@ export const isGoogleTagId = (id: string): boolean =>
 export const googleTagKind = (id: string): GoogleTagKind | null =>
   !isGoogleTagId(id) ? null : id.startsWith('GTM-') ? 'gtm' : 'gtag'
 
-export interface GoogleTagOptions extends ConsentOptions {
-  /** `GTM-…`, `G-…`, `GT-…`, `AW-…` or `DC-…` — see {@link isGoogleTagId}. */
-  id: string
-  /**
-   * The queue name, when a page runs more than one tag. Consent Mode from `@owlmeans/consent` —
-   * the bootstrap AND the dialog's later updates — always speaks on `window.dataLayer`, so a tag
-   * given another queue never hears a consent command. Leave it unset on a consent-gated page.
-   */
-  dataLayerName?: string
-  /** See {@link GOOGLE_TAG_DEFAULT_MODE}. Defaults to `GOOGLE_TAG_DEFAULT_MODE` (`'basic'`). */
-  mode?: GoogleTagMode
-}
-
-/** A queue name has to be a plain identifier: it becomes `window[name]` in the emitted script. */
-const JS_IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/
-
 const layerOf = (opts: GoogleTagOptions): string =>
   opts.dataLayerName != null && JS_IDENTIFIER.test(opts.dataLayerName)
     ? opts.dataLayerName
@@ -274,48 +211,6 @@ export const googleTagHeadScript = (opts: GoogleTagOptions): string => {
   return inlineSafe(`${bootstrap};${redaction};${loader}`)
 }
 
-/**
- * The hosts a page running a Google tag has to allow in `script-src`, `connect-src` and
- * `img-src`, for Google Analytics 4, Tag Manager and Google Ads together.
- *
- * Taken from Google's CSP guide (developers.google.com/tag-platform/security/guides/csp) and
- * folded into one list, because the platform adds one list to all three directives:
- *
- * - `*.googletagmanager.com` — gtm.js and gtag/js (`www.`), and their measurement pings;
- * - `*.google-analytics.com` — GA4 collection (`region1.`, `www.`);
- * - `*.g.doubleclick.net` — GA4 with Google signals and Ads (`stats.g.`, `googleads.g.`);
- * - `ad.doubleclick.net` — Ads and Floodlight conversions;
- * - `www.googleadservices.com` — the Ads conversion script;
- * - `pagead2.googlesyndication.com` — Ads and GA4-with-ads pings;
- * - `*.google.com` — `www.google.com` (the Ads script, consent-mode pings), `adservice.`, and the
- *   `analytics.google.com` collection endpoints.
- *
- * Every entry is an `https://` scheme, an optional `*.` label and a dotted host — the only shape
- * the publisher's CSP filter lets through — and there are few enough to stay inside its per-slot
- * cap. Google's country domains (`google.<TLD>`) cannot be named in that shape and are left out:
- * what is lost is a remarketing ping from visitors on those domains, never the tag itself.
- */
-export const GOOGLE_TAG_CSP_SOURCES: readonly string[] = Object.freeze([
-  'https://*.googletagmanager.com',
-  'https://*.google-analytics.com',
-  'https://*.g.doubleclick.net',
-  'https://ad.doubleclick.net',
-  'https://www.googleadservices.com',
-  'https://pagead2.googlesyndication.com',
-  'https://*.google.com',
-])
-
-/**
- * The hosts a Google tag frames: Tag Manager's service-worker and preview frames, and the Ads
- * remarketing frame. For `frame-src`, which otherwise stays `'none'`.
- */
-export const GOOGLE_TAG_FRAME_SOURCES: readonly string[] = Object.freeze([
-  'https://www.googletagmanager.com',
-  'https://td.doubleclick.net',
-])
-
-const GOOGLE = 'Google LLC'
-const GOOGLE_PRIVACY = 'https://policies.google.com/privacy'
 
 const analyticsService = (name: string, purpose: string, cookies: string[]): ConsentService => ({
   name, provider: GOOGLE, category: CONSENT_ANALYTICS, purpose, cookies, privacyHref: GOOGLE_PRIVACY,
@@ -325,10 +220,6 @@ const adsService = (name: string, purpose: string, cookies: string[]): ConsentSe
   name, provider: GOOGLE, category: CONSENT_MARKETING, purpose, cookies, privacyHref: GOOGLE_PRIVACY,
 })
 
-const UNTIL_ANALYTICS = 'Until analytics cookies are accepted it sets no cookies and sends only '
-  + 'cookieless measurement signals.'
-const UNTIL_MARKETING = 'Until marketing cookies are accepted it sets no cookies and ad click '
-  + 'identifiers are redacted.'
 
 /**
  * What a Google tag discloses on the cookie policy, for `CookiePolicy`'s `services`.
@@ -387,3 +278,6 @@ export const googleTagServices = (id: string): ConsentService[] => {
     }
   }
 }
+
+export type { GoogleTagKind, GoogleTagMode, GoogleTagOptions, GtmOptions } from './types.js'
+export { GOOGLE_TAG_CSP_SOURCES, GOOGLE_TAG_DEFAULT_MODE, GOOGLE_TAG_FRAME_SOURCES } from './consts.js'

package/src/types.ts

@@ -0,0 +1,33 @@
+import type { ConsentOptions } from '@owlmeans/consent'
+
+/** `'gtm'` container / `'gtag'` — see {@link GtmOptions.mode} / {@link GoogleTagOptions.mode}. */
+export type GoogleTagMode = 'basic' | 'advanced'
+
+export interface GtmOptions extends ConsentOptions {
+  /** Container id, e.g. `GTM-XXXXXXX`. */
+  id: string
+  /** The queue name, when a page runs more than one container. */
+  dataLayerName?: string
+  /** See {@link GOOGLE_TAG_DEFAULT_MODE}. Defaults to `GOOGLE_TAG_DEFAULT_MODE` (`'basic'`). */
+  mode?: GoogleTagMode
+}
+
+/**
+ * Which loader an id takes: `gtm` is the Tag Manager container (`gtm.js`), `gtag` the Google tag
+ * (`gtag.js`) — Google Analytics 4 (`G-`), a Google tag (`GT-`), Google Ads (`AW-`) and
+ * Floodlight (`DC-`).
+ */
+export type GoogleTagKind = 'gtm' | 'gtag'
+
+export interface GoogleTagOptions extends ConsentOptions {
+  /** `GTM-…`, `G-…`, `GT-…`, `AW-…` or `DC-…` — see {@link isGoogleTagId}. */
+  id: string
+  /**
+   * The queue name, when a page runs more than one tag. Consent Mode from `@owlmeans/consent` —
+   * the bootstrap AND the dialog's later updates — always speaks on `window.dataLayer`, so a tag
+   * given another queue never hears a consent command. Leave it unset on a consent-gated page.
+   */
+  dataLayerName?: string
+  /** See {@link GOOGLE_TAG_DEFAULT_MODE}. Defaults to `GOOGLE_TAG_DEFAULT_MODE` (`'basic'`). */
+  mode?: GoogleTagMode
+}

package/tests/tag.spec.ts

@@ -1,12 +1,7 @@
 import { describe, expect, test } from 'bun:test'
-import {
-  CONSENT_EVENT, CONSENT_KEY, DEFAULT_CONSENT_CATEGORIES, consentBootstrapScript,
-} from '@owlmeans/consent'
-import type { ConsentCategory } from '@owlmeans/consent'
-import {
-  GOOGLE_TAG_CSP_SOURCES, GOOGLE_TAG_FRAME_SOURCES, googleTagHeadScript, googleTagKind,
-  googleTagServices, isGoogleTagId,
-} from '../src/index.js'
+import { CONSENT_EVENT, CONSENT_KEY, DEFAULT_CONSENT_CATEGORIES, consentBootstrapScript, type ConsentCategory } from '@owlmeans/consent'
+import { googleTagHeadScript, googleTagKind, googleTagServices, isGoogleTagId } from '../src/index.js'
+import { GOOGLE_TAG_CSP_SOURCES, GOOGLE_TAG_FRAME_SOURCES } from '../src/consts.js'
 
 /**
  * The publisher's filter for slot-supplied CSP sources (`CSP_SOURCE_SHAPE` in viable's