@owlmeans/web-gtm 0.1.18-rc.8 → 0.1.18

package/build/consts.local.js

@@ -0,0 +1,20 @@
+/**
+ * The id shapes Google issues today, and nothing else.
+ *
+ * Deliberately strict — upper case, a known prefix, a bounded run of letters and digits — because
+ * the id is typed by a person into a settings form and ends up inside an inline script and a
+ * script URL. A value this pattern accepts cannot carry a quote, a tag or a second parameter, so
+ * the check is what makes it safe to store, not only to emit. `UA-` is not here: Universal
+ * Analytics stopped processing data in 2024, and accepting its ids would promise measurement that
+ * never arrives.
+ */
+export const GOOGLE_TAG_ID = /^(GTM-[A-Z0-9]{4,12}|(G|GT|AW|DC)-[A-Z0-9]{4,16})$/;
+/** A queue name has to be a plain identifier: it becomes `window[name]` in the emitted script. */
+export const JS_IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+export const GOOGLE = 'Google LLC';
+export const GOOGLE_PRIVACY = 'https://policies.google.com/privacy';
+export const UNTIL_ANALYTICS = 'Until analytics cookies are accepted it sets no cookies and sends only '
+    + 'cookieless measurement signals.';
+export const UNTIL_MARKETING = 'Until marketing cookies are accepted it sets no cookies and ad click '
+    + 'identifiers are redacted.';
+//# sourceMappingURL=consts.local.js.map

package/build/consts.local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.local.js","sourceRoot":"","sources":["../src/consts.local.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,oDAAoD,CAAA;AAEjF,kGAAkG;AAClG,MAAM,CAAC,MAAM,aAAa,GAAG,4BAA4B,CAAA;AAEzD,MAAM,CAAC,MAAM,MAAM,GAAG,YAAY,CAAA;AAElC,MAAM,CAAC,MAAM,cAAc,GAAG,qCAAqC,CAAA;AAEnE,MAAM,CAAC,MAAM,eAAe,GAAG,yEAAyE;MACpG,iCAAiC,CAAA;AAErC,MAAM,CAAC,MAAM,eAAe,GAAG,uEAAuE;MAClG,2BAA2B,CAAA"}

package/build/index.d.ts

@@ -1,30 +1,5 @@
-import type { ConsentOptions } from '@owlmeans/consent';
-export interface GtmOptions extends ConsentOptions {
-    /** Container id, e.g. `GTM-XXXXXXX`. */
-    id: string;
-    /** The queue name, when a page runs more than one container. */
-    dataLayerName?: string;
-}
-/**
- * The inline `<head>` snippet, consent first and the container second.
- *
- * The ORDER is the whole point of this package. Google Tag Manager decides what a tag may do from
- * the consent state present when the container loads, and a React bundle cannot get there first —
- * by the time an island mounts, the container has been running for hundreds of milliseconds. A
- * site whose defaults arrive after `gtm.js` is not configured differently; it is unconfigured for
- * the window that matters, and nothing in the page reports it.
- *
- * Emit this into the document head, above everything else, as an inline script.
- */
-export declare const gtmHeadScript: (opts: GtmOptions) => string;
-/** The `<noscript>` iframe, for the body. */
-export declare const gtmNoscriptFrame: (opts: GtmOptions) => string;
-/**
- * Load the container from script, for a host that cannot emit into its own head.
- *
- * The head snippet is strictly better and should be preferred; this exists for a single-page app
- * whose HTML is not ours to edit. It still pushes the defaults first, and it still refuses to load
- * a second time.
- */
-export declare const loadGtm: (opts: GtmOptions) => void;
+export type * from './tag/types.js';
+export * from './tag.js';
+export type { GoogleTagKind, GoogleTagMode, GoogleTagOptions, GtmOptions } from './types.js';
+export { GOOGLE_TAG_CSP_SOURCES, GOOGLE_TAG_DEFAULT_MODE, GOOGLE_TAG_FRAME_SOURCES } from './consts.js';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEvD,MAAM,WAAW,UAAW,SAAQ,cAAc;IAChD,wCAAwC;IACxC,EAAE,EAAE,MAAM,CAAA;IACV,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa,SAAU,UAAU,KAAG,MAWhD,CAAA;AAED,6CAA6C;AAC7C,eAAO,MAAM,gBAAgB,SAAU,UAAU,KAAG,MAEsB,CAAA;AAE1E;;;;;;GAMG;AACH,eAAO,MAAM,OAAO,SAAU,UAAU,KAAG,IAkB1C,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,gBAAgB,CAAA;AACnC,cAAc,UAAU,CAAA;AACxB,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAC5F,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA"}

package/build/index.js

@@ -1,52 +1,3 @@
-import { consentBootstrapScript, consentStore } from '@owlmeans/consent';
-/**
- * The inline `<head>` snippet, consent first and the container second.
- *
- * The ORDER is the whole point of this package. Google Tag Manager decides what a tag may do from
- * the consent state present when the container loads, and a React bundle cannot get there first —
- * by the time an island mounts, the container has been running for hundreds of milliseconds. A
- * site whose defaults arrive after `gtm.js` is not configured differently; it is unconfigured for
- * the window that matters, and nothing in the page reports it.
- *
- * Emit this into the document head, above everything else, as an inline script.
- */
-export const gtmHeadScript = (opts) => {
-    const layer = opts.dataLayerName ?? 'dataLayer';
-    return `${consentBootstrapScript(opts)};` +
-        `(function(w,d,s,l,i){w[l]=w[l]||[];` +
-        `w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});` +
-        `var f=d.getElementsByTagName(s)[0],j=d.createElement(s),` +
-        `dl=l!='dataLayer'?'&l='+l:'';j.async=true;` +
-        `j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;` +
-        `f.parentNode.insertBefore(j,f)})` +
-        `(window,document,'script',${JSON.stringify(layer)},${JSON.stringify(opts.id)})`;
-};
-/** The `<noscript>` iframe, for the body. */
-export const gtmNoscriptFrame = (opts) => `<iframe src="https://www.googletagmanager.com/ns.html?id=${encodeURIComponent(opts.id)}"` +
-    ` height="0" width="0" style="display:none;visibility:hidden"></iframe>`;
-/**
- * Load the container from script, for a host that cannot emit into its own head.
- *
- * The head snippet is strictly better and should be preferred; this exists for a single-page app
- * whose HTML is not ours to edit. It still pushes the defaults first, and it still refuses to load
- * a second time.
- */
-export const loadGtm = (opts) => {
-    if (typeof document === 'undefined') {
-        return;
-    }
-    const marker = `owl-gtm-${opts.id}`;
-    if (document.getElementById(marker) != null) {
-        return;
-    }
-    // Defaults before the container, every time — the same rule the head snippet exists to keep.
-    consentStore.init(opts);
-    const layer = opts.dataLayerName ?? 'dataLayer';
-    const script = document.createElement('script');
-    script.id = marker;
-    script.async = true;
-    script.src = `https://www.googletagmanager.com/gtm.js?id=${encodeURIComponent(opts.id)}`
-        + (layer !== 'dataLayer' ? `&l=${encodeURIComponent(layer)}` : '');
-    document.head.appendChild(script);
-};
+export * from './tag.js';
+export { GOOGLE_TAG_CSP_SOURCES, GOOGLE_TAG_DEFAULT_MODE, GOOGLE_TAG_FRAME_SOURCES } from './consts.js';
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAUxE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAgB,EAAU,EAAE;IACxD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,IAAI,WAAW,CAAA;IAE/C,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG;QACvC,qCAAqC;QACrC,+DAA+D;QAC/D,0DAA0D;QAC1D,4CAA4C;QAC5C,2DAA2D;QAC3D,kCAAkC;QAClC,6BAA6B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAA;AACpF,CAAC,CAAA;AAED,6CAA6C;AAC7C,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAgB,EAAU,EAAE,CAC3D,4DAA4D,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG;IAC1F,wEAAwE,CAAA;AAE1E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAgB,EAAQ,EAAE;IAChD,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE,CAAC;QACpC,OAAM;IACR,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,IAAI,CAAC,EAAE,EAAE,CAAA;IACnC,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QAC5C,OAAM;IACR,CAAC;IACD,6FAA6F;IAC7F,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEvB,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,IAAI,WAAW,CAAA;IAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAA;IAC/C,MAAM,CAAC,EAAE,GAAG,MAAM,CAAA;IAClB,MAAM,CAAC,KAAK,GAAG,IAAI,CAAA;IACnB,MAAM,CAAC,GAAG,GAAG,8CAA8C,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;UACpF,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACpE,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;AACnC,CAAC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,UAAU,CAAA;AAExB,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA"}

package/build/tag/types.d.ts

@@ -0,0 +1,82 @@
+import type { ConsentService } from '@owlmeans/consent';
+import type { GoogleTagKind, GoogleTagOptions, GtmOptions } from '../types.js';
+/** A Google tag behind consent: its inline head script, its fallbacks, its id rules, its disclosure. */
+export interface GoogleTagHelper {
+    /**
+     * The inline `<head>` snippet, consent first and the container second.
+     *
+     * The ORDER is the whole point of this package. Google Tag Manager decides what a tag may do from
+     * the consent state present when the container loads, and a React bundle cannot get there first —
+     * by the time an island mounts, the container has been running for hundreds of milliseconds. A
+     * site whose defaults arrive after `gtm.js` is not configured differently; it is unconfigured for
+     * the window that matters, and nothing in the page reports it.
+     *
+     * Emit this into the document head, above everything else, as an inline script.
+     *
+     * In `GOOGLE_TAG_DEFAULT_MODE` (`'basic'`) the container is not requested at all until a
+     * signal-bearing category is granted — {@link consentGateScript} wraps it, reading any stored
+     * decision immediately and otherwise waiting for `@owlmeans/consent`'s `CONSENT_EVENT`. Pass
+     * `mode: 'advanced'` for the original, unconditional load.
+     */
+    gtmHeadScript: (opts: GtmOptions) => string;
+    /**
+     * The `<noscript>` iframe, for the body.
+     *
+     * In `'basic'` mode this is an empty string: the whole point of gating is that an unauthenticated
+     * `<noscript>` iframe would defeat it — a browser with JavaScript disabled cannot have granted
+     * anything, so there is nothing lawful left to render. `'advanced'` keeps the frame.
+     */
+    gtmNoscriptFrame: (opts: GtmOptions) => string;
+    /**
+     * Load the container from script, for a host that cannot emit into its own head.
+     *
+     * The head snippet is strictly better and should be preferred; this exists for a single-page app
+     * whose HTML is not ours to edit. It still pushes the defaults first, and it still refuses to load
+     * a second time.
+     *
+     * In `'basic'` mode the container element is not appended until `trackingGranted` is true: either
+     * the stored record already grants it, or — since this runs after the bundle mounted, past the
+     * window the head snippet exists to close — a subscription to `consentStore` catches the first
+     * update where it becomes true and unsubscribes. `'advanced'` appends it immediately, as before.
+     */
+    loadGtm: (opts: GtmOptions) => void;
+    /** Whether `id` is a Tag Manager container or Google tag id this package can load. */
+    isGoogleTagId: (id: string) => boolean;
+    /** The loader `id` takes, or `null` when it is not a loadable id at all. */
+    googleTagKind: (id: string) => GoogleTagKind | null;
+    /**
+     * The one inline `<head>` script for a Google tag of any kind: the consent bootstrap FIRST, then
+     * ads redaction, then the loader the id's prefix calls for — the Tag Manager container for `GTM-`,
+     * gtag.js with `js` and `config` for `G-`, `GT-`, `AW-` and `DC-`.
+     *
+     * The order is the rule {@link gtmHeadScript} exists for, and it holds for gtag.js just the same:
+     * a tag decides what it may do from the consent state present when it loads. The bootstrap
+     * declares everything denied and applies any stored decision in the same turn, so a returning
+     * visitor's tag starts granted and a new visitor's starts cookieless.
+     *
+     * An id that is not a loadable id ({@link isGoogleTagId}) yields the consent bootstrap alone — a
+     * page must never lose its consent defaults because someone mistyped a tag. The result is safe to
+     * place inline in HTML as-is: `</` and `<!--` inside any configured value are escaped.
+     *
+     * In `GOOGLE_TAG_DEFAULT_MODE` (`'basic'`) the loader itself — the last piece — is wrapped in
+     * `consentGateScript`: it runs immediately for a returning visitor whose stored record already
+     * grants a signal-bearing category, and otherwise waits for `@owlmeans/consent`'s `CONSENT_EVENT`
+     * before ever requesting the tag. The bootstrap and the redaction flags are unaffected and still
+     * run unconditionally — Consent Mode's OWN denied-by-default signals are declared either way, so a
+     * tag that later does load still starts from `ad_storage`/`analytics_storage` denied. Pass
+     * `mode: 'advanced'` for the original, unconditional load.
+     */
+    googleTagHeadScript: (opts: GoogleTagOptions) => string;
+    /**
+     * What a Google tag discloses on the cookie policy, for `CookiePolicy`'s `services`.
+     *
+     * Read off the id's prefix, because that is all the page knows: `G-` is Google Analytics 4
+     * (`_ga`, and `_ga_<id without G->` which carries the session), `AW-` Google Ads, `DC-` Floodlight.
+     * A `GTM-` container and a `GT-` Google tag route to whatever their owner configured at Google,
+     * so both are disclosed as an analytics AND an advertising entry, worded as configured there —
+     * the policy may not claim less than the tag can do. An invalid id discloses nothing, matching
+     * {@link googleTagHeadScript}, which loads nothing for it.
+     */
+    googleTagServices: (id: string) => ConsentService[];
+}
+//# sourceMappingURL=types.d.ts.map

package/build/tag/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/tag/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAE9E,wGAAwG;AACxG,MAAM,WAAW,eAAe;IAC9B;;;;;;;;;;;;;;;OAeG;IACH,aAAa,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,MAAM,CAAA;IAC3C;;;;;;OAMG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,MAAM,CAAA;IAC9C;;;;;;;;;;;OAWG;IACH,OAAO,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,CAAA;IACnC,sFAAsF;IACtF,aAAa,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAA;IACtC,4EAA4E;IAC5E,aAAa,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,aAAa,GAAG,IAAI,CAAA;IACnD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,mBAAmB,EAAE,CAAC,IAAI,EAAE,gBAAgB,KAAK,MAAM,CAAA;IACvD;;;;;;;;;OASG;IACH,iBAAiB,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,cAAc,EAAE,CAAA;CACpD"}

package/build/tag/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/tag/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/tag/types.ts"],"names":[],"mappings":""}

package/build/tag.d.ts

@@ -0,0 +1,16 @@
+import { type ConsentService } from '@owlmeans/consent';
+import type { GoogleTagOptions, GtmOptions } from './types.js';
+import type { GoogleTagHelper } from './tag/types.js';
+export declare const createGoogleTagHelper: () => GoogleTagHelper;
+export declare const googleTagHelper: GoogleTagHelper;
+/** @deprecated compat:factory-refactor — use `googleTagHelper.gtmHeadScript(…)` */
+export declare const gtmHeadScript: (opts: GtmOptions) => string;
+/** @deprecated compat:factory-refactor — use `googleTagHelper.gtmNoscriptFrame(…)` */
+export declare const gtmNoscriptFrame: (opts: GtmOptions) => string;
+/** @deprecated compat:factory-refactor — use `googleTagHelper.isGoogleTagId(…)` */
+export declare const isGoogleTagId: (id: string) => boolean;
+/** @deprecated compat:factory-refactor — use `googleTagHelper.googleTagHeadScript(…)` */
+export declare const googleTagHeadScript: (opts: GoogleTagOptions) => string;
+/** @deprecated compat:factory-refactor — use `googleTagHelper.googleTagServices(…)` */
+export declare const googleTagServices: (id: string) => ConsentService[];
+//# sourceMappingURL=tag.d.ts.map

package/build/tag.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tag.d.ts","sourceRoot":"","sources":["../src/tag.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyE,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAG9H,OAAO,KAAK,EAAiB,gBAAgB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAC7E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAErD,eAAO,MAAM,qBAAqB,QAAO,eAiNxC,CAAA;AAED,eAAO,MAAM,eAAe,iBAA0B,CAAA;AAEtD,mFAAmF;AACnF,eAAO,MAAM,aAAa,SAAU,UAAU,KAAG,MAA6C,CAAA;AAE9F,sFAAsF;AACtF,eAAO,MAAM,gBAAgB,SAAU,UAAU,KAAG,MAAgD,CAAA;AAEpG,mFAAmF;AACnF,eAAO,MAAM,aAAa,OAAQ,MAAM,KAAG,OAA4C,CAAA;AAEvF,yFAAyF;AACzF,eAAO,MAAM,mBAAmB,SAAU,gBAAgB,KAAG,MAAmD,CAAA;AAEhH,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,OAAQ,MAAM,KAAG,cAAc,EAA2C,CAAA"}

package/build/tag.js

@@ -0,0 +1,172 @@
+import { CONSENT_ANALYTICS, CONSENT_MARKETING, consentModeHelper, consentStore } from '@owlmeans/consent';
+import { GOOGLE, GOOGLE_PRIVACY, GOOGLE_TAG_ID, JS_IDENTIFIER, UNTIL_ANALYTICS, UNTIL_MARKETING } from './consts.local.js';
+import { GOOGLE_TAG_DEFAULT_MODE } from './consts.js';
+export const createGoogleTagHelper = () => {
+    /** Google's own container IIFE, the id and queue name injected as JSON data. */
+    const gtmContainerScript = (layer, id) => `(function(w,d,s,l,i){w[l]=w[l]||[];` +
+        `w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});` +
+        `var f=d.getElementsByTagName(s)[0],j=d.createElement(s),` +
+        `dl=l!='dataLayer'?'&l='+l:'';j.async=true;` +
+        `j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;` +
+        `f.parentNode.insertBefore(j,f)})` +
+        `(window,document,'script',${JSON.stringify(layer)},${JSON.stringify(id)})`;
+    const gtmHeadScript = (opts) => {
+        const bootstrap = consentModeHelper.consentBootstrapScript(opts);
+        const loader = gtmContainerScript(opts.dataLayerName ?? 'dataLayer', opts.id);
+        if ((opts.mode ?? GOOGLE_TAG_DEFAULT_MODE) === 'basic') {
+            return `${bootstrap};${consentModeHelper.consentGateScript(loader, opts)}`;
+        }
+        return `${bootstrap};${loader}`;
+    };
+    const gtmNoscriptFrame = (opts) => {
+        if ((opts.mode ?? GOOGLE_TAG_DEFAULT_MODE) === 'basic') {
+            return '';
+        }
+        return `<iframe src="https://www.googletagmanager.com/ns.html?id=${encodeURIComponent(opts.id)}"` +
+            ` height="0" width="0" style="display:none;visibility:hidden"></iframe>`;
+    };
+    const loadGtm = (opts) => {
+        if (typeof document === 'undefined') {
+            return;
+        }
+        const marker = `owl-gtm-${opts.id}`;
+        if (document.getElementById(marker) != null) {
+            return;
+        }
+        // Defaults before the container, every time — the same rule the head snippet exists to keep.
+        consentStore.init(opts);
+        const inject = () => {
+            if (document.getElementById(marker) != null) {
+                return;
+            }
+            const layer = opts.dataLayerName ?? 'dataLayer';
+            const script = document.createElement('script');
+            script.id = marker;
+            script.async = true;
+            script.src = `https://www.googletagmanager.com/gtm.js?id=${encodeURIComponent(opts.id)}`
+                + (layer !== 'dataLayer' ? `&l=${encodeURIComponent(layer)}` : '');
+            document.head.appendChild(script);
+        };
+        if ((opts.mode ?? GOOGLE_TAG_DEFAULT_MODE) !== 'basic') {
+            inject();
+            return;
+        }
+        if (consentModeHelper.trackingGranted(consentStore.get().record, opts.categories)) {
+            inject();
+            return;
+        }
+        const unsubscribe = consentStore.subscribe(state => {
+            if (consentModeHelper.trackingGranted(state.record, opts.categories)) {
+                unsubscribe();
+                inject();
+            }
+        });
+    };
+    const isGoogleTagId = (id) => typeof id === 'string' && GOOGLE_TAG_ID.test(id);
+    const googleTagKind = (id) => !isGoogleTagId(id) ? null : id.startsWith('GTM-') ? 'gtm' : 'gtag';
+    const layerOf = (opts) => opts.dataLayerName != null && JS_IDENTIFIER.test(opts.dataLayerName)
+        ? opts.dataLayerName
+        : 'dataLayer';
+    /**
+     * Make a generated script safe to place between `<script>` and `</script>`.
+     *
+     * JSON encoding keeps a value inside its string literal, but the HTML parser does not read
+     * JavaScript: it ends the element at the first `</script` it meets, wherever it sits, and a
+     * `<!--` can switch it into a state where the real closing tag is swallowed. Both sequences can
+     * only appear inside the JSON-encoded values here — category keys, a storage key, a queue name —
+     * so each gets a backslash that JavaScript reads as nothing (`\/` is `/`, `\!` is `!`).
+     */
+    const inlineSafe = (script) => script.replace(/<\//g, '<\\/').replace(/<!--/g, '<\\!--');
+    /**
+     * Ads data redaction on, URL passthrough off — before any loader runs.
+     *
+     * `ads_data_redaction` makes an Ads or Floodlight tag strip ad-click identifiers and send its
+     * requests through a cookieless domain while `ad_storage` is denied. `url_passthrough` is set to
+     * its default explicitly so that nothing configured later on the page can switch on decorating
+     * links with click ids for a visitor who refused marketing storage. Google reads both only when
+     * they are set ahead of the tag's `config`.
+     */
+    const redactionScript = (layer) => `(function(w,l){w[l]=w[l]||[];function g(){w[l].push(arguments)}` +
+        `g('set','ads_data_redaction',true);g('set','url_passthrough',false)})` +
+        `(window,${JSON.stringify(layer)})`;
+    /**
+     * Google's gtag.js snippet as one inline script: the queue function, `js` and `config`, then the
+     * library requested from here rather than from a second `<script src>` element.
+     *
+     * One inline script instead of Google's two elements because the document it lands in is served
+     * with a hash-based CSP and stamped by a build that writes one head snippet — a second element
+     * would be a second thing to keep in order. The element carries an id derived from the tag, so a
+     * page that runs the snippet twice (two stampings, a hot reload) does not configure the tag twice
+     * and double-count every page view. `window.gtag` is published only when nothing else owns it, so
+     * application code can send its own events.
+     */
+    const gtagScript = (layer, id) => `(function(w,d,l,i){var m='owl-gtag-'+i;if(d.getElementById(m))return;` +
+        `w[l]=w[l]||[];function g(){w[l].push(arguments)}if(!w.gtag)w.gtag=g;` +
+        `g('js',new Date());g('config',i);` +
+        `var j=d.createElement('script');j.id=m;j.async=true;` +
+        `j.src='https://www.googletagmanager.com/gtag/js?id='+encodeURIComponent(i)` +
+        `+(l!='dataLayer'?'&l='+encodeURIComponent(l):'');` +
+        `(d.head||d.documentElement).appendChild(j)})` +
+        `(window,document,${JSON.stringify(layer)},${JSON.stringify(id)})`;
+    const googleTagHeadScript = (opts) => {
+        const bootstrap = consentModeHelper.consentBootstrapScript(opts);
+        const kind = googleTagKind(opts.id);
+        if (kind == null) {
+            return inlineSafe(bootstrap);
+        }
+        const layer = layerOf(opts);
+        const loader = kind === 'gtm' ? gtmContainerScript(layer, opts.id) : gtagScript(layer, opts.id);
+        const redaction = redactionScript(layer);
+        if ((opts.mode ?? GOOGLE_TAG_DEFAULT_MODE) === 'basic') {
+            return inlineSafe(`${bootstrap};${redaction};${consentModeHelper.consentGateScript(loader, opts)}`);
+        }
+        return inlineSafe(`${bootstrap};${redaction};${loader}`);
+    };
+    const analyticsService = (name, purpose, cookies) => ({
+        name, provider: GOOGLE, category: CONSENT_ANALYTICS, purpose, cookies, privacyHref: GOOGLE_PRIVACY,
+    });
+    const adsService = (name, purpose, cookies) => ({
+        name, provider: GOOGLE, category: CONSENT_MARKETING, purpose, cookies, privacyHref: GOOGLE_PRIVACY,
+    });
+    const googleTagServices = (id) => {
+        if (!isGoogleTagId(id)) {
+            return [];
+        }
+        const prefix = id.slice(0, id.indexOf('-'));
+        switch (prefix) {
+            case 'G':
+                return [analyticsService('Google Analytics', 'Measures how visitors use the site — pages viewed, time spent, device and approximate '
+                        + `location — so it can be improved. ${UNTIL_ANALYTICS}`, ['_ga', `_ga_${id.slice(2)}`])];
+            case 'AW':
+                return [adsService('Google Ads', 'Measures which ads led to a visit or a sign-up, and may add visitors to audiences for '
+                        + `showing them ads elsewhere. ${UNTIL_MARKETING}`, ['_gcl_au', '_gcl_aw'])];
+            case 'DC':
+                return [adsService('Google Campaign Manager 360 (Floodlight)', `Measures which ad campaigns led to a visit or a sign-up. ${UNTIL_MARKETING}`, ['_gcl_au', '_gcl_dc'])];
+            default: {
+                const source = prefix === 'GTM' ? 'Google Tag Manager' : 'Google tag';
+                const where = prefix === 'GTM' ? 'in its container' : 'for it at Google';
+                return [
+                    analyticsService(`${source} — analytics`, `Runs the analytics tags configured ${where}, typically Google Analytics. `
+                        + UNTIL_ANALYTICS, ['_ga', '_ga_*']),
+                    adsService(`${source} — advertising`, `Runs the advertising tags configured ${where}, typically Google Ads conversion `
+                        + `tracking and remarketing. ${UNTIL_MARKETING}`, ['_gcl_au', '_gcl_aw']),
+                ];
+            }
+        }
+    };
+    return {
+        gtmHeadScript, gtmNoscriptFrame, loadGtm, isGoogleTagId, googleTagKind, googleTagHeadScript, googleTagServices,
+    };
+};
+export const googleTagHelper = createGoogleTagHelper();
+/** @deprecated compat:factory-refactor — use `googleTagHelper.gtmHeadScript(…)` */
+export const gtmHeadScript = (opts) => googleTagHelper.gtmHeadScript(opts);
+/** @deprecated compat:factory-refactor — use `googleTagHelper.gtmNoscriptFrame(…)` */
+export const gtmNoscriptFrame = (opts) => googleTagHelper.gtmNoscriptFrame(opts);
+/** @deprecated compat:factory-refactor — use `googleTagHelper.isGoogleTagId(…)` */
+export const isGoogleTagId = (id) => googleTagHelper.isGoogleTagId(id);
+/** @deprecated compat:factory-refactor — use `googleTagHelper.googleTagHeadScript(…)` */
+export const googleTagHeadScript = (opts) => googleTagHelper.googleTagHeadScript(opts);
+/** @deprecated compat:factory-refactor — use `googleTagHelper.googleTagServices(…)` */
+export const googleTagServices = (id) => googleTagHelper.googleTagServices(id);
+//# sourceMappingURL=tag.js.map

package/build/tag.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tag.js","sourceRoot":"","sources":["../src/tag.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,YAAY,EAAuB,MAAM,mBAAmB,CAAA;AAC9H,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAC1H,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAIrD,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAoB,EAAE;IACzD,gFAAgF;IAChF,MAAM,kBAAkB,GAAG,CAAC,KAAa,EAAE,EAAU,EAAU,EAAE,CAC/D,qCAAqC;QACrC,+DAA+D;QAC/D,0DAA0D;QAC1D,4CAA4C;QAC5C,2DAA2D;QAC3D,kCAAkC;QAClC,6BAA6B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,CAAA;IAE7E,MAAM,aAAa,GAAG,CAAC,IAAgB,EAAU,EAAE;QACjD,MAAM,SAAS,GAAG,iBAAiB,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAA;QAChE,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,aAAa,IAAI,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QAE7E,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,uBAAuB,CAAC,KAAK,OAAO,EAAE,CAAC;YACvD,OAAO,GAAG,SAAS,IAAI,iBAAiB,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAA;QAC5E,CAAC;QAED,OAAO,GAAG,SAAS,IAAI,MAAM,EAAE,CAAA;IACjC,CAAC,CAAA;IAED,MAAM,gBAAgB,GAAG,CAAC,IAAgB,EAAU,EAAE;QACpD,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,uBAAuB,CAAC,KAAK,OAAO,EAAE,CAAC;YACvD,OAAO,EAAE,CAAA;QACX,CAAC;QAED,OAAO,4DAA4D,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG;YAC/F,wEAAwE,CAAA;IAC5E,CAAC,CAAA;IAED,MAAM,OAAO,GAAG,CAAC,IAAgB,EAAQ,EAAE;QACzC,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE,CAAC;YACpC,OAAM;QACR,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,IAAI,CAAC,EAAE,EAAE,CAAA;QACnC,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YAC5C,OAAM;QACR,CAAC;QACD,6FAA6F;QAC7F,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEvB,MAAM,MAAM,GAAG,GAAS,EAAE;YACxB,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC5C,OAAM;YACR,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,IAAI,WAAW,CAAA;YAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAA;YAC/C,MAAM,CAAC,EAAE,GAAG,MAAM,CAAA;YAClB,MAAM,CAAC,KAAK,GAAG,IAAI,CAAA;YACnB,MAAM,CAAC,GAAG,GAAG,8CAA8C,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;kBACpF,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;YACpE,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QACnC,CAAC,CAAA;QAED,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,uBAAuB,CAAC,KAAK,OAAO,EAAE,CAAC;YACvD,MAAM,EAAE,CAAA;YAER,OAAM;QACR,CAAC;QAED,IAAI,iBAAiB,CAAC,eAAe,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAClF,MAAM,EAAE,CAAA;YAER,OAAM;QACR,CAAC;QAED,MAAM,WAAW,GAAG,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;YACjD,IAAI,iBAAiB,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACrE,WAAW,EAAE,CAAA;gBACb,MAAM,EAAE,CAAA;YACV,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,MAAM,aAAa,GAAG,CAAC,EAAU,EAAW,EAAE,CAC5C,OAAO,EAAE,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAElD,MAAM,aAAa,GAAG,CAAC,EAAU,EAAwB,EAAE,CACzD,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;IAEpE,MAAM,OAAO,GAAG,CAAC,IAAsB,EAAU,EAAE,CACjD,IAAI,CAAC,aAAa,IAAI,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;QAClE,CAAC,CAAC,IAAI,CAAC,aAAa;QACpB,CAAC,CAAC,WAAW,CAAA;IAEjB;;;;;;;;OAQG;IACH,MAAM,UAAU,GAAG,CAAC,MAAc,EAAU,EAAE,CAC5C,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IAE3D;;;;;;;;OAQG;IACH,MAAM,eAAe,GAAG,CAAC,KAAa,EAAU,EAAE,CAChD,iEAAiE;QACjE,uEAAuE;QACvE,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAA;IAErC;;;;;;;;;;OAUG;IACH,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,EAAU,EAAU,EAAE,CACvD,uEAAuE;QACvE,sEAAsE;QACtE,mCAAmC;QACnC,sDAAsD;QACtD,4EAA4E;QAC5E,mDAAmD;QACnD,8CAA8C;QAC9C,oBAAoB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,CAAA;IAEpE,MAAM,mBAAmB,GAAG,CAAC,IAAsB,EAAU,EAAE;QAC7D,MAAM,SAAS,GAAG,iBAAiB,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAA;QAChE,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACnC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;YACjB,OAAO,UAAU,CAAC,SAAS,CAAC,CAAA;QAC9B,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QAC3B,MAAM,MAAM,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/F,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;QAExC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,uBAAuB,CAAC,KAAK,OAAO,EAAE,CAAC;YACvD,OAAO,UAAU,CAAC,GAAG,SAAS,IAAI,SAAS,IAAI,iBAAiB,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QACrG,CAAC;QAED,OAAO,UAAU,CAAC,GAAG,SAAS,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC,CAAA;IAC1D,CAAC,CAAA;IAED,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,OAAiB,EAAkB,EAAE,CAAC,CAAC;QAC9F,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc;KACnG,CAAC,CAAA;IAEF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,OAAiB,EAAkB,EAAE,CAAC,CAAC;QACxF,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc;KACnG,CAAC,CAAA;IAEF,MAAM,iBAAiB,GAAG,CAAC,EAAU,EAAoB,EAAE;QACzD,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,CAAA;QACX,CAAC;QACD,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;QAC3C,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,GAAG;gBACN,OAAO,CAAC,gBAAgB,CACtB,kBAAkB,EAClB,wFAAwF;0BACpF,qCAAqC,eAAe,EAAE,EAC1D,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAC9B,CAAC,CAAA;YACJ,KAAK,IAAI;gBACP,OAAO,CAAC,UAAU,CAChB,YAAY,EACZ,wFAAwF;0BACpF,+BAA+B,eAAe,EAAE,EACpD,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC,CAAA;YACJ,KAAK,IAAI;gBACP,OAAO,CAAC,UAAU,CAChB,0CAA0C,EAC1C,4DAA4D,eAAe,EAAE,EAC7E,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC,CAAA;YACJ,SAAS,CAAC;gBACR,MAAM,MAAM,GAAG,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,YAAY,CAAA;gBACrE,MAAM,KAAK,GAAG,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAA;gBAExE,OAAO;oBACL,gBAAgB,CACd,GAAG,MAAM,cAAc,EACvB,sCAAsC,KAAK,gCAAgC;0BACvE,eAAe,EACnB,CAAC,KAAK,EAAE,OAAO,CAAC,CACjB;oBACD,UAAU,CACR,GAAG,MAAM,gBAAgB,EACzB,wCAAwC,KAAK,oCAAoC;0BAC7E,6BAA6B,eAAe,EAAE,EAClD,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB;iBACF,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAA;IAED,OAAO;QACL,aAAa,EAAE,gBAAgB,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,mBAAmB,EAAE,iBAAiB;KAC/G,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,qBAAqB,EAAE,CAAA;AAEtD,mFAAmF;AACnF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAgB,EAAU,EAAE,CAAC,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;AAE9F,sFAAsF;AACtF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAgB,EAAU,EAAE,CAAC,eAAe,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAA;AAEpG,mFAAmF;AACnF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,EAAU,EAAW,EAAE,CAAC,eAAe,CAAC,aAAa,CAAC,EAAE,CAAC,CAAA;AAEvF,yFAAyF;AACzF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,IAAsB,EAAU,EAAE,CAAC,eAAe,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAA;AAEhH,uFAAuF;AACvF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,EAAU,EAAoB,EAAE,CAAC,eAAe,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAA"}

package/build/types.d.ts

@@ -0,0 +1,30 @@
+import type { ConsentOptions } from '@owlmeans/consent';
+/** `'gtm'` container / `'gtag'` — see {@link GtmOptions.mode} / {@link GoogleTagOptions.mode}. */
+export type GoogleTagMode = 'basic' | 'advanced';
+export interface GtmOptions extends ConsentOptions {
+    /** Container id, e.g. `GTM-XXXXXXX`. */
+    id: string;
+    /** The queue name, when a page runs more than one container. */
+    dataLayerName?: string;
+    /** See {@link GOOGLE_TAG_DEFAULT_MODE}. Defaults to `GOOGLE_TAG_DEFAULT_MODE` (`'basic'`). */
+    mode?: GoogleTagMode;
+}
+/**
+ * Which loader an id takes: `gtm` is the Tag Manager container (`gtm.js`), `gtag` the Google tag
+ * (`gtag.js`) — Google Analytics 4 (`G-`), a Google tag (`GT-`), Google Ads (`AW-`) and
+ * Floodlight (`DC-`).
+ */
+export type GoogleTagKind = 'gtm' | 'gtag';
+export interface GoogleTagOptions extends ConsentOptions {
+    /** `GTM-…`, `G-…`, `GT-…`, `AW-…` or `DC-…` — see {@link isGoogleTagId}. */
+    id: string;
+    /**
+     * The queue name, when a page runs more than one tag. Consent Mode from `@owlmeans/consent` —
+     * the bootstrap AND the dialog's later updates — always speaks on `window.dataLayer`, so a tag
+     * given another queue never hears a consent command. Leave it unset on a consent-gated page.
+     */
+    dataLayerName?: string;
+    /** See {@link GOOGLE_TAG_DEFAULT_MODE}. Defaults to `GOOGLE_TAG_DEFAULT_MODE` (`'basic'`). */
+    mode?: GoogleTagMode;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEvD,kGAAkG;AAClG,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,UAAU,CAAA;AAEhD,MAAM,WAAW,UAAW,SAAQ,cAAc;IAChD,wCAAwC;IACxC,EAAE,EAAE,MAAM,CAAA;IACV,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,8FAA8F;IAC9F,IAAI,CAAC,EAAE,aAAa,CAAA;CACrB;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,MAAM,CAAA;AAE1C,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,4EAA4E;IAC5E,EAAE,EAAE,MAAM,CAAA;IACV;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,8FAA8F;IAC9F,IAAI,CAAC,EAAE,aAAa,CAAA;CACrB"}

package/build/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/web-gtm",
-  "version": "0.1.18-rc.8",
+  "version": "0.1.18",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -22,11 +22,11 @@
     }
   },
   "dependencies": {
-    "@owlmeans/consent": "^0.1.18-rc.4"
+    "@owlmeans/consent": "^0.1.18"
   },
   "devDependencies": {
-    "@owlmeans/dep-config": "workspace:*",
-    "@types/bun": "^1.4.0",
+    "@owlmeans/dep-config": "^0.1.18",
+    "@types/bun": "^1.4.2",
     "nodemon": "^3.1.14",
     "typescript": "^7.0.2"
   },

package/src/consts.local.ts

@@ -0,0 +1,24 @@
+/**
+ * The id shapes Google issues today, and nothing else.
+ *
+ * Deliberately strict — upper case, a known prefix, a bounded run of letters and digits — because
+ * the id is typed by a person into a settings form and ends up inside an inline script and a
+ * script URL. A value this pattern accepts cannot carry a quote, a tag or a second parameter, so
+ * the check is what makes it safe to store, not only to emit. `UA-` is not here: Universal
+ * Analytics stopped processing data in 2024, and accepting its ids would promise measurement that
+ * never arrives.
+ */
+export const GOOGLE_TAG_ID = /^(GTM-[A-Z0-9]{4,12}|(G|GT|AW|DC)-[A-Z0-9]{4,16})$/
+
+/** A queue name has to be a plain identifier: it becomes `window[name]` in the emitted script. */
+export const JS_IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/
+
+export const GOOGLE = 'Google LLC'
+
+export const GOOGLE_PRIVACY = 'https://policies.google.com/privacy'
+
+export const UNTIL_ANALYTICS = 'Until analytics cookies are accepted it sets no cookies and sends only '
+  + 'cookieless measurement signals.'
+
+export const UNTIL_MARKETING = 'Until marketing cookies are accepted it sets no cookies and ad click '
+  + 'identifiers are redacted.'

package/src/consts.ts

@@ -0,0 +1,56 @@
+import type { GoogleTagMode } from './types.js'
+
+/**
+ * The platform default for {@link GtmOptions.mode} / {@link GoogleTagOptions.mode}.
+ *
+ * One named constant so flipping it later is a one-line change.
+ *
+ * - `'basic'` withholds the loader until a signal-bearing category is granted — which holds back
+ *   Google's own IP receipt too, not only what a granted tag may then do with it.
+ * - `'advanced'` loads immediately with Consent Mode signals denied — today's only behavior, and
+ *   Google's own recommended default for its own conversion modeling.
+ *
+ * Default is `'basic'`: read it as the EU/DE worst-case reading of ePrivacy Art. 5(3) — no third
+ * party receives a connection before consent.
+ */
+export const GOOGLE_TAG_DEFAULT_MODE: GoogleTagMode = 'basic'
+
+/**
+ * The hosts a page running a Google tag has to allow in `script-src`, `connect-src` and
+ * `img-src`, for Google Analytics 4, Tag Manager and Google Ads together.
+ *
+ * Taken from Google's CSP guide (developers.google.com/tag-platform/security/guides/csp) and
+ * folded into one list, because the platform adds one list to all three directives:
+ *
+ * - `*.googletagmanager.com` — gtm.js and gtag/js (`www.`), and their measurement pings;
+ * - `*.google-analytics.com` — GA4 collection (`region1.`, `www.`);
+ * - `*.g.doubleclick.net` — GA4 with Google signals and Ads (`stats.g.`, `googleads.g.`);
+ * - `ad.doubleclick.net` — Ads and Floodlight conversions;
+ * - `www.googleadservices.com` — the Ads conversion script;
+ * - `pagead2.googlesyndication.com` — Ads and GA4-with-ads pings;
+ * - `*.google.com` — `www.google.com` (the Ads script, consent-mode pings), `adservice.`, and the
+ *   `analytics.google.com` collection endpoints.
+ *
+ * Every entry is an `https://` scheme, an optional `*.` label and a dotted host — the only shape
+ * the publisher's CSP filter lets through — and there are few enough to stay inside its per-slot
+ * cap. Google's country domains (`google.<TLD>`) cannot be named in that shape and are left out:
+ * what is lost is a remarketing ping from visitors on those domains, never the tag itself.
+ */
+export const GOOGLE_TAG_CSP_SOURCES: readonly string[] = Object.freeze([
+  'https://*.googletagmanager.com',
+  'https://*.google-analytics.com',
+  'https://*.g.doubleclick.net',
+  'https://ad.doubleclick.net',
+  'https://www.googleadservices.com',
+  'https://pagead2.googlesyndication.com',
+  'https://*.google.com',
+])
+
+/**
+ * The hosts a Google tag frames: Tag Manager's service-worker and preview frames, and the Ads
+ * remarketing frame. For `frame-src`, which otherwise stays `'none'`.
+ */
+export const GOOGLE_TAG_FRAME_SOURCES: readonly string[] = Object.freeze([
+  'https://www.googletagmanager.com',
+  'https://td.doubleclick.net',
+])