@replohq/sdk 0.6.1 → 0.8.0

package/analytics/utils/analytics-utils.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../analytics/utils/analytics-utils.ts"],
-  "sourcesContent": ["// oxlint-disable-next-line typescript/no-explicit-any -- legacy any, may or may not be needed\ntype QueuedEvent = { event: string; params: Record<string, any> };\n\nexport function createEventQueue(\n  checkPixelReady: () => boolean,\n  // oxlint-disable-next-line typescript/no-explicit-any -- legacy any, may or may not be needed\n  sendEvent: (event: string, params: Record<string, any>) => void,\n  pixelName: string,\n  // oxlint-disable-next-line typescript/no-explicit-any -- legacy any, may or may not be needed\n): (event: string, params?: Record<string, any>) => void {\n  const queue: QueuedEvent[] = [];\n  let flushTimer: number | null = null;\n  let timeoutTimer: number | null = null;\n  let permanentlyDisabled = false;\n\n  const cleanup = () => {\n    if (flushTimer !== null) {\n      window.clearInterval(flushTimer);\n      flushTimer = null;\n    }\n    if (timeoutTimer !== null) {\n      window.clearTimeout(timeoutTimer);\n      timeoutTimer = null;\n    }\n  };\n\n  const flush = () => {\n    if (!checkPixelReady()) {\n      return;\n    }\n    console.debug(\n      `[analytics] flushing ${queue.length} queued events for ${pixelName}`,\n    );\n    try {\n      queue.forEach(({ event, params }) => sendEvent(event, params));\n    } finally {\n      queue.length = 0;\n      cleanup();\n    }\n  };\n\n  const scheduleFlush = () => {\n    if (typeof window === \"undefined\" || flushTimer !== null) {\n      return;\n    }\n\n    flushTimer = window.setInterval(flush, 500);\n    timeoutTimer = window.setTimeout(() => {\n      queue.length = 0;\n      permanentlyDisabled = true;\n      console.debug(\n        `Analytics queue timed out after 30 seconds for ${pixelName}`,\n      );\n      cleanup();\n    }, 30_000);\n  };\n\n  // oxlint-disable-next-line typescript/no-explicit-any -- legacy any, may or may not be needed\n  return (event: string, params: Record<string, any> = {}) => {\n    if (permanentlyDisabled) {\n      console.debug(\n        `[analytics] ${pixelName} queue is disabled, dropping event`,\n        event,\n      );\n      return;\n    }\n\n    if (checkPixelReady()) {\n      sendEvent(event, params);\n    } else {\n      queue.push({ event, params });\n      scheduleFlush();\n    }\n  };\n}\n\ntype MethodQueueOptions = {\n  queueName?: string;\n  onTimeout?: () => void;\n};\n\nexport function createMethodQueue<\n  // oxlint-disable-next-line typescript/no-explicit-any -- legacy any, may or may not be needed\n  InstanceType extends Record<string, (...args: any[]) => any>,\n>(\n  checkInstanceReady: () => InstanceType | null,\n  options?: MethodQueueOptions,\n  // oxlint-disable-next-line typescript/no-explicit-any -- legacy any, may or may not be needed\n): (method: keyof InstanceType, ...args: any[]) => void {\n  // oxlint-disable-next-line typescript/no-explicit-any -- legacy any, may or may not be needed\n  const queue: { method: keyof InstanceType; args: any[] }[] = [];\n  let flushTimer: number | null = null;\n  let timeoutTimer: number | null = null;\n  let permanentlyDisabled = false;\n  const queueName = options?.queueName ?? \"method queue\";\n\n  const cleanup = () => {\n    if (flushTimer !== null) {\n      window.clearInterval(flushTimer);\n      flushTimer = null;\n    }\n    if (timeoutTimer !== null) {\n      window.clearTimeout(timeoutTimer);\n      timeoutTimer = null;\n    }\n  };\n\n  const flush = () => {\n    const instance = checkInstanceReady();\n    if (!instance) {\n      return;\n    }\n    try {\n      queue.forEach(({ method, args }) => {\n        const methodFunction = instance[method];\n        if (typeof methodFunction === \"function\") {\n          void methodFunction.apply(instance, args);\n        }\n      });\n    } finally {\n      queue.length = 0;\n      cleanup();\n    }\n  };\n\n  const scheduleFlush = () => {\n    if (typeof window === \"undefined\" || flushTimer !== null) {\n      return;\n    }\n\n    flushTimer = window.setInterval(flush, 500);\n    timeoutTimer = window.setTimeout(() => {\n      queue.length = 0;\n      permanentlyDisabled = true;\n      if (typeof window !== \"undefined\") {\n        console.debug(\n          `[analytics] ${queueName} timed out after 30 seconds and has been disabled`,\n        );\n      }\n      options?.onTimeout?.();\n      cleanup();\n    }, 30_000);\n  };\n\n  // oxlint-disable-next-line typescript/no-explicit-any -- legacy any, may or may not be needed\n  return (method: keyof InstanceType, ...args: any[]) => {\n    if (permanentlyDisabled) {\n      return;\n    }\n\n    const instance = checkInstanceReady();\n    if (instance) {\n      const methodFunction = instance[method];\n      if (typeof methodFunction === \"function\") {\n        void methodFunction.apply(instance, args);\n      }\n    } else {\n      queue.push({ method, args });\n      scheduleFlush();\n    }\n  };\n}\n"],
-  "mappings": "AAGO,SAAS,iBACd,iBAEA,WACA,WAEuD;AACvD,QAAM,QAAuB,CAAC;AAC9B,MAAI,aAA4B;AAChC,MAAI,eAA8B;AAClC,MAAI,sBAAsB;AAE1B,QAAM,UAAU,MAAM;AACpB,QAAI,eAAe,MAAM;AACvB,aAAO,cAAc,UAAU;AAC/B,mBAAa;AAAA,IACf;AACA,QAAI,iBAAiB,MAAM;AACzB,aAAO,aAAa,YAAY;AAChC,qBAAe;AAAA,IACjB;AAAA,EACF;AAEA,QAAM,QAAQ,MAAM;AAClB,QAAI,CAAC,gBAAgB,GAAG;AACtB;AAAA,IACF;AACA,YAAQ;AAAA,MACN,wBAAwB,MAAM,MAAM,sBAAsB,SAAS;AAAA,IACrE;AACA,QAAI;AACF,YAAM,QAAQ,CAAC,EAAE,OAAO,OAAO,MAAM,UAAU,OAAO,MAAM,CAAC;AAAA,IAC/D,UAAE;AACA,YAAM,SAAS;AACf,cAAQ;AAAA,IACV;AAAA,EACF;AAEA,QAAM,gBAAgB,MAAM;AAC1B,QAAI,OAAO,WAAW,eAAe,eAAe,MAAM;AACxD;AAAA,IACF;AAEA,iBAAa,OAAO,YAAY,OAAO,GAAG;AAC1C,mBAAe,OAAO,WAAW,MAAM;AACrC,YAAM,SAAS;AACf,4BAAsB;AACtB,cAAQ;AAAA,QACN,kDAAkD,SAAS;AAAA,MAC7D;AACA,cAAQ;AAAA,IACV,GAAG,GAAM;AAAA,EACX;AAGA,SAAO,CAAC,OAAe,SAA8B,CAAC,MAAM;AAC1D,QAAI,qBAAqB;AACvB,cAAQ;AAAA,QACN,eAAe,SAAS;AAAA,QACxB;AAAA,MACF;AACA;AAAA,IACF;AAEA,QAAI,gBAAgB,GAAG;AACrB,gBAAU,OAAO,MAAM;AAAA,IACzB,OAAO;AACL,YAAM,KAAK,EAAE,OAAO,OAAO,CAAC;AAC5B,oBAAc;AAAA,IAChB;AAAA,EACF;AACF;AAOO,SAAS,kBAId,oBACA,SAEsD;AAEtD,QAAM,QAAuD,CAAC;AAC9D,MAAI,aAA4B;AAChC,MAAI,eAA8B;AAClC,MAAI,sBAAsB;AAC1B,QAAM,YAAY,SAAS,aAAa;AAExC,QAAM,UAAU,MAAM;AACpB,QAAI,eAAe,MAAM;AACvB,aAAO,cAAc,UAAU;AAC/B,mBAAa;AAAA,IACf;AACA,QAAI,iBAAiB,MAAM;AACzB,aAAO,aAAa,YAAY;AAChC,qBAAe;AAAA,IACjB;AAAA,EACF;AAEA,QAAM,QAAQ,MAAM;AAClB,UAAM,WAAW,mBAAmB;AACpC,QAAI,CAAC,UAAU;AACb;AAAA,IACF;AACA,QAAI;AACF,YAAM,QAAQ,CAAC,EAAE,QAAQ,KAAK,MAAM;AAClC,cAAM,iBAAiB,SAAS,MAAM;AACtC,YAAI,OAAO,mBAAmB,YAAY;AACxC,eAAK,eAAe,MAAM,UAAU,IAAI;AAAA,QAC1C;AAAA,MACF,CAAC;AAAA,IACH,UAAE;AACA,YAAM,SAAS;AACf,cAAQ;AAAA,IACV;AAAA,EACF;AAEA,QAAM,gBAAgB,MAAM;AAC1B,QAAI,OAAO,WAAW,eAAe,eAAe,MAAM;AACxD;AAAA,IACF;AAEA,iBAAa,OAAO,YAAY,OAAO,GAAG;AAC1C,mBAAe,OAAO,WAAW,MAAM;AACrC,YAAM,SAAS;AACf,4BAAsB;AACtB,UAAI,OAAO,WAAW,aAAa;AACjC,gBAAQ;AAAA,UACN,eAAe,SAAS;AAAA,QAC1B;AAAA,MACF;AACA,eAAS,YAAY;AACrB,cAAQ;AAAA,IACV,GAAG,GAAM;AAAA,EACX;AAGA,SAAO,CAAC,WAA+B,SAAgB;AACrD,QAAI,qBAAqB;AACvB;AAAA,IACF;AAEA,UAAM,WAAW,mBAAmB;AACpC,QAAI,UAAU;AACZ,YAAM,iBAAiB,SAAS,MAAM;AACtC,UAAI,OAAO,mBAAmB,YAAY;AACxC,aAAK,eAAe,MAAM,UAAU,IAAI;AAAA,MAC1C;AAAA,IACF,OAAO;AACL,YAAM,KAAK,EAAE,QAAQ,KAAK,CAAC;AAC3B,oBAAc;AAAA,IAChB;AAAA,EACF;AACF;",
+  "sourcesContent": ["// oxlint-disable-next-line typescript/no-explicit-any -- legacy any, may or may not be needed\ntype QueuedEvent = { event: string; params: Record<string, any> };\n\nconst QUEUE_TIMEOUT_MS = 30_000;\n\nexport function createEventQueue(\n  checkPixelReady: () => boolean,\n  // oxlint-disable-next-line typescript/no-explicit-any -- legacy any, may or may not be needed\n  sendEvent: (event: string, params: Record<string, any>) => void,\n  pixelName: string,\n  // oxlint-disable-next-line typescript/no-explicit-any -- legacy any, may or may not be needed\n): (event: string, params?: Record<string, any>) => void {\n  const queue: QueuedEvent[] = [];\n  let flushTimer: number | null = null;\n  let timeoutTimer: number | null = null;\n  let permanentlyDisabled = false;\n\n  const cleanup = () => {\n    if (flushTimer !== null) {\n      window.clearInterval(flushTimer);\n      flushTimer = null;\n    }\n    if (timeoutTimer !== null) {\n      window.clearTimeout(timeoutTimer);\n      timeoutTimer = null;\n    }\n  };\n\n  const flush = () => {\n    if (!checkPixelReady()) {\n      return;\n    }\n    console.debug(\n      `[analytics] flushing ${queue.length} queued events for ${pixelName}`,\n    );\n    try {\n      queue.forEach(({ event, params }) => sendEvent(event, params));\n    } finally {\n      queue.length = 0;\n      cleanup();\n    }\n  };\n\n  const scheduleFlush = () => {\n    if (typeof window === \"undefined\" || flushTimer !== null) {\n      return;\n    }\n\n    flushTimer = window.setInterval(flush, 500);\n    timeoutTimer = window.setTimeout(() => {\n      queue.length = 0;\n      permanentlyDisabled = true;\n      console.debug(`Analytics queue timed out for ${pixelName}`);\n      cleanup();\n    }, QUEUE_TIMEOUT_MS);\n  };\n\n  // oxlint-disable-next-line typescript/no-explicit-any -- legacy any, may or may not be needed\n  return (event: string, params: Record<string, any> = {}) => {\n    if (permanentlyDisabled) {\n      console.debug(\n        `[analytics] ${pixelName} queue is disabled, dropping event`,\n        event,\n      );\n      return;\n    }\n\n    if (checkPixelReady()) {\n      sendEvent(event, params);\n    } else {\n      queue.push({ event, params });\n      scheduleFlush();\n    }\n  };\n}\n\ntype MethodQueueOptions = {\n  queueName?: string;\n  onTimeout?: () => void;\n};\n\nexport function createMethodQueue<\n  // oxlint-disable-next-line typescript/no-explicit-any -- legacy any, may or may not be needed\n  InstanceType extends Record<string, (...args: any[]) => any>,\n>(\n  checkInstanceReady: () => InstanceType | null,\n  options?: MethodQueueOptions,\n  // oxlint-disable-next-line typescript/no-explicit-any -- legacy any, may or may not be needed\n): (method: keyof InstanceType, ...args: any[]) => void {\n  // oxlint-disable-next-line typescript/no-explicit-any -- legacy any, may or may not be needed\n  const queue: { method: keyof InstanceType; args: any[] }[] = [];\n  let flushTimer: number | null = null;\n  let timeoutTimer: number | null = null;\n  let permanentlyDisabled = false;\n  const queueName = options?.queueName ?? \"method queue\";\n\n  const cleanup = () => {\n    if (flushTimer !== null) {\n      window.clearInterval(flushTimer);\n      flushTimer = null;\n    }\n    if (timeoutTimer !== null) {\n      window.clearTimeout(timeoutTimer);\n      timeoutTimer = null;\n    }\n  };\n\n  const flush = () => {\n    const instance = checkInstanceReady();\n    if (!instance) {\n      return;\n    }\n    try {\n      queue.forEach(({ method, args }) => {\n        const methodFunction = instance[method];\n        if (typeof methodFunction === \"function\") {\n          void methodFunction.apply(instance, args);\n        }\n      });\n    } finally {\n      queue.length = 0;\n      cleanup();\n    }\n  };\n\n  const scheduleFlush = () => {\n    if (typeof window === \"undefined\" || flushTimer !== null) {\n      return;\n    }\n\n    flushTimer = window.setInterval(flush, 500);\n    timeoutTimer = window.setTimeout(() => {\n      queue.length = 0;\n      permanentlyDisabled = true;\n      if (typeof window !== \"undefined\") {\n        console.debug(\n          `[analytics] ${queueName} timed out and has been disabled`,\n        );\n      }\n      options?.onTimeout?.();\n      cleanup();\n    }, QUEUE_TIMEOUT_MS);\n  };\n\n  // oxlint-disable-next-line typescript/no-explicit-any -- legacy any, may or may not be needed\n  return (method: keyof InstanceType, ...args: any[]) => {\n    if (permanentlyDisabled) {\n      return;\n    }\n\n    const instance = checkInstanceReady();\n    if (instance) {\n      const methodFunction = instance[method];\n      if (typeof methodFunction === \"function\") {\n        void methodFunction.apply(instance, args);\n      }\n    } else {\n      queue.push({ method, args });\n      scheduleFlush();\n    }\n  };\n}\n"],
+  "mappings": "AAGA,MAAM,mBAAmB;AAElB,SAAS,iBACd,iBAEA,WACA,WAEuD;AACvD,QAAM,QAAuB,CAAC;AAC9B,MAAI,aAA4B;AAChC,MAAI,eAA8B;AAClC,MAAI,sBAAsB;AAE1B,QAAM,UAAU,MAAM;AACpB,QAAI,eAAe,MAAM;AACvB,aAAO,cAAc,UAAU;AAC/B,mBAAa;AAAA,IACf;AACA,QAAI,iBAAiB,MAAM;AACzB,aAAO,aAAa,YAAY;AAChC,qBAAe;AAAA,IACjB;AAAA,EACF;AAEA,QAAM,QAAQ,MAAM;AAClB,QAAI,CAAC,gBAAgB,GAAG;AACtB;AAAA,IACF;AACA,YAAQ;AAAA,MACN,wBAAwB,MAAM,MAAM,sBAAsB,SAAS;AAAA,IACrE;AACA,QAAI;AACF,YAAM,QAAQ,CAAC,EAAE,OAAO,OAAO,MAAM,UAAU,OAAO,MAAM,CAAC;AAAA,IAC/D,UAAE;AACA,YAAM,SAAS;AACf,cAAQ;AAAA,IACV;AAAA,EACF;AAEA,QAAM,gBAAgB,MAAM;AAC1B,QAAI,OAAO,WAAW,eAAe,eAAe,MAAM;AACxD;AAAA,IACF;AAEA,iBAAa,OAAO,YAAY,OAAO,GAAG;AAC1C,mBAAe,OAAO,WAAW,MAAM;AACrC,YAAM,SAAS;AACf,4BAAsB;AACtB,cAAQ,MAAM,iCAAiC,SAAS,EAAE;AAC1D,cAAQ;AAAA,IACV,GAAG,gBAAgB;AAAA,EACrB;AAGA,SAAO,CAAC,OAAe,SAA8B,CAAC,MAAM;AAC1D,QAAI,qBAAqB;AACvB,cAAQ;AAAA,QACN,eAAe,SAAS;AAAA,QACxB;AAAA,MACF;AACA;AAAA,IACF;AAEA,QAAI,gBAAgB,GAAG;AACrB,gBAAU,OAAO,MAAM;AAAA,IACzB,OAAO;AACL,YAAM,KAAK,EAAE,OAAO,OAAO,CAAC;AAC5B,oBAAc;AAAA,IAChB;AAAA,EACF;AACF;AAOO,SAAS,kBAId,oBACA,SAEsD;AAEtD,QAAM,QAAuD,CAAC;AAC9D,MAAI,aAA4B;AAChC,MAAI,eAA8B;AAClC,MAAI,sBAAsB;AAC1B,QAAM,YAAY,SAAS,aAAa;AAExC,QAAM,UAAU,MAAM;AACpB,QAAI,eAAe,MAAM;AACvB,aAAO,cAAc,UAAU;AAC/B,mBAAa;AAAA,IACf;AACA,QAAI,iBAAiB,MAAM;AACzB,aAAO,aAAa,YAAY;AAChC,qBAAe;AAAA,IACjB;AAAA,EACF;AAEA,QAAM,QAAQ,MAAM;AAClB,UAAM,WAAW,mBAAmB;AACpC,QAAI,CAAC,UAAU;AACb;AAAA,IACF;AACA,QAAI;AACF,YAAM,QAAQ,CAAC,EAAE,QAAQ,KAAK,MAAM;AAClC,cAAM,iBAAiB,SAAS,MAAM;AACtC,YAAI,OAAO,mBAAmB,YAAY;AACxC,eAAK,eAAe,MAAM,UAAU,IAAI;AAAA,QAC1C;AAAA,MACF,CAAC;AAAA,IACH,UAAE;AACA,YAAM,SAAS;AACf,cAAQ;AAAA,IACV;AAAA,EACF;AAEA,QAAM,gBAAgB,MAAM;AAC1B,QAAI,OAAO,WAAW,eAAe,eAAe,MAAM;AACxD;AAAA,IACF;AAEA,iBAAa,OAAO,YAAY,OAAO,GAAG;AAC1C,mBAAe,OAAO,WAAW,MAAM;AACrC,YAAM,SAAS;AACf,4BAAsB;AACtB,UAAI,OAAO,WAAW,aAAa;AACjC,gBAAQ;AAAA,UACN,eAAe,SAAS;AAAA,QAC1B;AAAA,MACF;AACA,eAAS,YAAY;AACrB,cAAQ;AAAA,IACV,GAAG,gBAAgB;AAAA,EACrB;AAGA,SAAO,CAAC,WAA+B,SAAgB;AACrD,QAAI,qBAAqB;AACvB;AAAA,IACF;AAEA,UAAM,WAAW,mBAAmB;AACpC,QAAI,UAAU;AACZ,YAAM,iBAAiB,SAAS,MAAM;AACtC,UAAI,OAAO,mBAAmB,YAAY;AACxC,aAAK,eAAe,MAAM,UAAU,IAAI;AAAA,MAC1C;AAAA,IACF,OAAO;AACL,YAAM,KAAK,EAAE,QAAQ,KAAK,CAAC;AAC3B,oBAAc;AAAA,IAChB;AAAA,EACF;AACF;",
   "names": []
 }

package/consent/consent-platform.d.ts

@@ -0,0 +1,52 @@
+import type { ConsentCategories } from "./cookie";
+import type { ConsentCategory, ReploScriptEntry, ScriptTagDescriptor } from "./types";
+export interface ConsentPlatformConfig {
+    id: string;
+    loader: ScriptTagDescriptor[];
+    blockingAttribute: {
+        name: string;
+        values: Partial<Record<ConsentCategory, string>>;
+    };
+    /** Cookiebot preset only: enables consent read-back and runScripts re-scan. */
+    isCookiebot: boolean;
+}
+/** Whether this entry connects a consent platform (vs a tracker it would gate). */
+export declare function isConsentPlatformEntry(entry: ReploScriptEntry): boolean;
+/** The connected platform's config, or null when Replo's banner owns consent. */
+export declare function findConsentPlatform(scripts: ReploScriptEntry[]): ConsentPlatformConfig | null;
+/** Blocks a gated script; `text/plain` is unconditional so an unmapped category fails closed. */
+export declare function getBlockingAttributes(config: ConsentPlatformConfig, requiredConsent: ConsentCategory[]): Record<string, string>;
+/** The bits of Cookiebot's `window.Cookiebot` global we read. */
+interface CookiebotGlobal {
+    consent?: Partial<Record<CookiebotCategory, boolean>>;
+    hasResponse?: boolean;
+    runScripts?: () => void;
+}
+type CookiebotCategory = "necessary" | "preferences" | "statistics" | "marketing";
+declare global {
+    interface Window {
+        Cookiebot?: CookiebotGlobal;
+    }
+}
+type OptionalConsentCategory = Exclude<ConsentCategory, "necessary">;
+export declare const OPTIONAL_CONSENT_CATEGORIES: readonly ["analytics", "marketing", "preferences", "sale_of_data"];
+/** The delegated platform, or null when Replo's own banner owns consent. */
+export declare function findDelegatedPlatform(): ConsentPlatformConfig | null;
+/** The platform's answer as Replo consent. */
+export declare function getDelegatedConsent(): {
+    categories: ConsentCategories;
+    decidedAt: number | null;
+};
+/** Inline marker a generic CMP executes when it releases one consent category. */
+export declare function buildGrantMarker(category: OptionalConsentCategory): ScriptTagDescriptor;
+/** Latches the platform as the consent backend; un-delegating would need a reload, as native revocation already does. */
+export declare function enableConsentDelegation(config: ConsentPlatformConfig): void;
+/** Cookiebot-only re-scan; other platforms rely on the loader injecting after every tag. */
+export declare function activateBlockedScripts(): void;
+/** Subscribe to delegated-consent changes. Returns an unsubscribe function. */
+export declare function subscribeToConsentDelegation(listener: () => void): () => void;
+/** Replaces navigation in tests so withdrawal behavior can be asserted. */
+export declare function setConsentPlatformReloadForTests(reload: () => void): void;
+/** Test-only reset; leaves subscriptions alone so the store's own stays attached. */
+export declare function resetConsentPlatformForTests(): void;
+export {};

package/consent/consent-platform.js

@@ -0,0 +1,223 @@
+import { z } from "zod";
+import { DENIED_CATEGORIES } from "./cookie";
+const COOKIEBOT_CATEGORY_BY_CONSENT = {
+  analytics: "statistics",
+  marketing: "marketing",
+  preferences: "preferences",
+  sale_of_data: "marketing"
+};
+function cookiebotPreset(identifier) {
+  return {
+    id: "cookiebot",
+    loader: [
+      {
+        kind: "external",
+        src: "https://consent.cookiebot.com/uc.js",
+        attributes: {
+          id: "Cookiebot",
+          "data-cbid": identifier
+          // No data-blockingmode: uc.js only ever checks for "auto"; manual is
+          // its coded default, so any other value (or absence) is identical.
+        }
+      }
+    ],
+    blockingAttribute: {
+      name: "data-cookieconsent",
+      values: COOKIEBOT_CATEGORY_BY_CONSENT
+    },
+    isCookiebot: true
+  };
+}
+function isConsentPlatformEntry(entry) {
+  return entry.type === "Cookiebot" || entry.type === "consentPlatform";
+}
+function findConsentPlatform(scripts) {
+  for (const entry of scripts) {
+    if (entry.type === "Cookiebot") {
+      return cookiebotPreset(entry.identifier);
+    }
+    if (entry.type === "consentPlatform") {
+      return {
+        id: entry.id,
+        loader: [
+          { kind: "external", src: entry.src, attributes: entry.attributes }
+        ],
+        blockingAttribute: entry.blockingAttribute,
+        isCookiebot: false
+      };
+    }
+  }
+  return null;
+}
+function getBlockingAttributes(config, requiredConsent) {
+  const gated = requiredConsent.filter((category) => category !== "necessary");
+  if (gated.length === 0) {
+    return {};
+  }
+  const tokens = [
+    ...new Set(
+      gated.flatMap(
+        (category) => config.blockingAttribute.values[category] ?? []
+      )
+    )
+  ];
+  return {
+    type: "text/plain",
+    ...tokens.length > 0 ? { [config.blockingAttribute.name]: tokens.join(",") } : {}
+  };
+}
+const COOKIEBOT_EVENTS = [
+  "CookiebotOnConsentReady",
+  "CookiebotOnAccept",
+  "CookiebotOnDecline"
+];
+const OPTIONAL_CONSENT_CATEGORIES = [
+  "analytics",
+  "marketing",
+  "preferences",
+  "sale_of_data"
+];
+const genericConsentCategorySchema = z.enum(OPTIONAL_CONSENT_CATEGORIES);
+const GENERIC_CONSENT_GRANTED_EVENT = "reploConsentCategoryGranted";
+let delegatedPlatform = null;
+let listeningToCookiebot = false;
+let listeningToGenericPlatform = false;
+let categories = DENIED_CATEGORIES;
+let decidedAt = null;
+const listeners = /* @__PURE__ */ new Set();
+const reloadCurrentPage = () => window.location.reload();
+let reloadPage = reloadCurrentPage;
+function findDelegatedPlatform() {
+  return delegatedPlatform;
+}
+function getDelegatedConsent() {
+  return { categories, decidedAt };
+}
+function readCookiebotConsent() {
+  const cookiebot = typeof window === "undefined" ? void 0 : window.Cookiebot;
+  if (!cookiebot?.consent || cookiebot.hasResponse !== true) {
+    return { hasChanged: false, hasDowngrade: false };
+  }
+  const consent = cookiebot.consent;
+  const next = {
+    necessary: true,
+    analytics: consent.statistics === true,
+    marketing: consent.marketing === true,
+    preferences: consent.preferences === true,
+    sale_of_data: consent.marketing === true
+  };
+  const unchanged = next.analytics === categories.analytics && next.marketing === categories.marketing && next.preferences === categories.preferences && next.sale_of_data === categories.sale_of_data;
+  if (decidedAt !== null && unchanged) {
+    return { hasChanged: false, hasDowngrade: false };
+  }
+  const hasDowngrade = decidedAt !== null && OPTIONAL_CONSENT_CATEGORIES.some((category) => {
+    return categories[category] && !next[category];
+  });
+  categories = next;
+  decidedAt = Date.now();
+  return { hasChanged: true, hasDowngrade };
+}
+function notifyConsentListeners() {
+  for (const listener of listeners) {
+    listener();
+  }
+}
+function handleCookiebotEvent() {
+  const result = readCookiebotConsent();
+  if (!result.hasChanged) {
+    return;
+  }
+  notifyConsentListeners();
+  if (result.hasDowngrade) {
+    reloadPage();
+  }
+}
+function handleGenericConsentActivation(event) {
+  if (!(event instanceof CustomEvent)) {
+    return;
+  }
+  const result = genericConsentCategorySchema.safeParse(event.detail);
+  if (!result.success || categories[result.data]) {
+    return;
+  }
+  categories = { ...categories, [result.data]: true };
+  decidedAt = Date.now();
+  notifyConsentListeners();
+}
+function buildGrantMarker(category) {
+  return {
+    kind: "inline",
+    body: `document.dispatchEvent(new CustomEvent(${JSON.stringify(GENERIC_CONSENT_GRANTED_EVENT)}, { detail: ${JSON.stringify(category)} }));`
+  };
+}
+function enableConsentDelegation(config) {
+  if (typeof window === "undefined" || delegatedPlatform) {
+    return;
+  }
+  delegatedPlatform = config;
+  if (config.isCookiebot && !listeningToCookiebot) {
+    listeningToCookiebot = true;
+    for (const event of COOKIEBOT_EVENTS) {
+      window.addEventListener(event, handleCookiebotEvent);
+    }
+  }
+  if (!config.isCookiebot && !listeningToGenericPlatform) {
+    listeningToGenericPlatform = true;
+    document.addEventListener(
+      GENERIC_CONSENT_GRANTED_EVENT,
+      handleGenericConsentActivation
+    );
+  }
+  if (config.isCookiebot) {
+    readCookiebotConsent();
+  }
+}
+function activateBlockedScripts() {
+  if (!delegatedPlatform?.isCookiebot) {
+    return;
+  }
+  window.Cookiebot?.runScripts?.();
+}
+function subscribeToConsentDelegation(listener) {
+  listeners.add(listener);
+  return () => {
+    listeners.delete(listener);
+  };
+}
+function setConsentPlatformReloadForTests(reload) {
+  reloadPage = reload;
+}
+function resetConsentPlatformForTests() {
+  if (typeof window !== "undefined" && listeningToCookiebot) {
+    for (const event of COOKIEBOT_EVENTS) {
+      window.removeEventListener(event, handleCookiebotEvent);
+    }
+  }
+  if (typeof document !== "undefined" && listeningToGenericPlatform) {
+    document.removeEventListener(
+      GENERIC_CONSENT_GRANTED_EVENT,
+      handleGenericConsentActivation
+    );
+  }
+  delegatedPlatform = null;
+  listeningToCookiebot = false;
+  listeningToGenericPlatform = false;
+  categories = DENIED_CATEGORIES;
+  decidedAt = null;
+  reloadPage = reloadCurrentPage;
+}
+export {
+  OPTIONAL_CONSENT_CATEGORIES,
+  activateBlockedScripts,
+  buildGrantMarker,
+  enableConsentDelegation,
+  findConsentPlatform,
+  findDelegatedPlatform,
+  getBlockingAttributes,
+  getDelegatedConsent,
+  isConsentPlatformEntry,
+  resetConsentPlatformForTests,
+  setConsentPlatformReloadForTests,
+  subscribeToConsentDelegation
+};
+//# sourceMappingURL=consent-platform.js.map

package/consent/consent-platform.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../consent/consent-platform.ts"],
+  "sourcesContent": ["import type { ConsentCategories } from \"./cookie\";\nimport type {\n  ConsentCategory,\n  ReploScriptEntry,\n  ScriptTagDescriptor,\n} from \"./types\";\n\nimport { z } from \"zod\";\n\nimport { DENIED_CATEGORIES } from \"./cookie\";\n\n// A connected consent platform owns consent instead of Replo's banner: managed\n// tags are blocked until it activates them, and Replo stores no consent itself.\n\nexport interface ConsentPlatformConfig {\n  id: string;\n  loader: ScriptTagDescriptor[];\n  blockingAttribute: {\n    name: string;\n    values: Partial<Record<ConsentCategory, string>>;\n  };\n  /** Cookiebot preset only: enables consent read-back and runScripts re-scan. */\n  isCookiebot: boolean;\n}\n\n/** Cookiebot's fixed vocabulary. It has no sale-of-data category, so marketing covers it; `necessary` is never blocked. The `satisfies` makes a future ConsentCategory a compile error instead of a script that silently runs before consent. */\nconst COOKIEBOT_CATEGORY_BY_CONSENT: Partial<Record<ConsentCategory, string>> =\n  {\n    analytics: \"statistics\",\n    marketing: \"marketing\",\n    preferences: \"preferences\",\n    sale_of_data: \"marketing\",\n  } satisfies Record<Exclude<ConsentCategory, \"necessary\">, string>;\n\nfunction cookiebotPreset(identifier: string): ConsentPlatformConfig {\n  return {\n    id: \"cookiebot\",\n    loader: [\n      {\n        kind: \"external\",\n        src: \"https://consent.cookiebot.com/uc.js\",\n        attributes: {\n          id: \"Cookiebot\",\n          \"data-cbid\": identifier,\n          // No data-blockingmode: uc.js only ever checks for \"auto\"; manual is\n          // its coded default, so any other value (or absence) is identical.\n        },\n      },\n    ],\n    blockingAttribute: {\n      name: \"data-cookieconsent\",\n      values: COOKIEBOT_CATEGORY_BY_CONSENT,\n    },\n    isCookiebot: true,\n  };\n}\n\n/** Whether this entry connects a consent platform (vs a tracker it would gate). */\nexport function isConsentPlatformEntry(entry: ReploScriptEntry): boolean {\n  return entry.type === \"Cookiebot\" || entry.type === \"consentPlatform\";\n}\n\n/** The connected platform's config, or null when Replo's banner owns consent. */\nexport function findConsentPlatform(\n  scripts: ReploScriptEntry[],\n): ConsentPlatformConfig | null {\n  for (const entry of scripts) {\n    if (entry.type === \"Cookiebot\") {\n      return cookiebotPreset(entry.identifier);\n    }\n    if (entry.type === \"consentPlatform\") {\n      return {\n        id: entry.id,\n        loader: [\n          { kind: \"external\", src: entry.src, attributes: entry.attributes },\n        ],\n        blockingAttribute: entry.blockingAttribute,\n        isCookiebot: false,\n      };\n    }\n  }\n  return null;\n}\n\n/** Blocks a gated script; `text/plain` is unconditional so an unmapped category fails closed. */\nexport function getBlockingAttributes(\n  config: ConsentPlatformConfig,\n  requiredConsent: ConsentCategory[],\n): Record<string, string> {\n  const gated = requiredConsent.filter((category) => category !== \"necessary\");\n  if (gated.length === 0) {\n    return {};\n  }\n  const tokens = [\n    ...new Set(\n      gated.flatMap(\n        (category) => config.blockingAttribute.values[category] ?? [],\n      ),\n    ),\n  ];\n  return {\n    type: \"text/plain\",\n    ...(tokens.length > 0\n      ? { [config.blockingAttribute.name]: tokens.join(\",\") }\n      : {}),\n  };\n}\n\n/** The bits of Cookiebot's `window.Cookiebot` global we read. */\ninterface CookiebotGlobal {\n  consent?: Partial<Record<CookiebotCategory, boolean>>;\n  hasResponse?: boolean;\n  runScripts?: () => void;\n}\n\ntype CookiebotCategory =\n  | \"necessary\"\n  | \"preferences\"\n  | \"statistics\"\n  | \"marketing\";\n\ndeclare global {\n  interface Window {\n    Cookiebot?: CookiebotGlobal;\n  }\n}\n\n/** `CookiebotOnConsentReady` also fires on load for an already-stored answer, catching returning visitors. */\nconst COOKIEBOT_EVENTS = [\n  \"CookiebotOnConsentReady\",\n  \"CookiebotOnAccept\",\n  \"CookiebotOnDecline\",\n] as const;\n\ntype OptionalConsentCategory = Exclude<ConsentCategory, \"necessary\">;\n\nexport const OPTIONAL_CONSENT_CATEGORIES = [\n  \"analytics\",\n  \"marketing\",\n  \"preferences\",\n  \"sale_of_data\",\n] as const satisfies readonly OptionalConsentCategory[];\n\nconst genericConsentCategorySchema = z.enum(OPTIONAL_CONSENT_CATEGORIES);\nconst GENERIC_CONSENT_GRANTED_EVENT = \"reploConsentCategoryGranted\";\n\nlet delegatedPlatform: ConsentPlatformConfig | null = null;\nlet listeningToCookiebot = false;\nlet listeningToGenericPlatform = false;\nlet categories: ConsentCategories = DENIED_CATEGORIES;\nlet decidedAt: number | null = null;\nconst listeners = new Set<() => void>();\nconst reloadCurrentPage = () => window.location.reload();\nlet reloadPage = reloadCurrentPage;\n\n/** The delegated platform, or null when Replo's own banner owns consent. */\nexport function findDelegatedPlatform(): ConsentPlatformConfig | null {\n  return delegatedPlatform;\n}\n\n/** The platform's answer as Replo consent. */\nexport function getDelegatedConsent(): {\n  categories: ConsentCategories;\n  decidedAt: number | null;\n} {\n  return { categories, decidedAt };\n}\n\ninterface CookiebotConsentReadResult {\n  hasChanged: boolean;\n  hasDowngrade: boolean;\n}\n\n/** Reads Cookiebot's answer into module state. */\nfunction readCookiebotConsent(): CookiebotConsentReadResult {\n  const cookiebot =\n    typeof window === \"undefined\" ? undefined : window.Cookiebot;\n  if (!cookiebot?.consent || cookiebot.hasResponse !== true) {\n    return { hasChanged: false, hasDowngrade: false };\n  }\n  const consent = cookiebot.consent;\n  const next: ConsentCategories = {\n    necessary: true,\n    analytics: consent.statistics === true,\n    marketing: consent.marketing === true,\n    preferences: consent.preferences === true,\n    sale_of_data: consent.marketing === true,\n  };\n  // Consumers memoize on the categories object, so only replace it when the answer moved.\n  const unchanged =\n    next.analytics === categories.analytics &&\n    next.marketing === categories.marketing &&\n    next.preferences === categories.preferences &&\n    next.sale_of_data === categories.sale_of_data;\n  if (decidedAt !== null && unchanged) {\n    return { hasChanged: false, hasDowngrade: false };\n  }\n  const hasDowngrade =\n    decidedAt !== null &&\n    OPTIONAL_CONSENT_CATEGORIES.some((category) => {\n      return categories[category] && !next[category];\n    });\n  categories = next;\n  decidedAt = Date.now();\n  return { hasChanged: true, hasDowngrade };\n}\n\nfunction notifyConsentListeners() {\n  for (const listener of listeners) {\n    listener();\n  }\n}\n\nfunction handleCookiebotEvent() {\n  const result = readCookiebotConsent();\n  if (!result.hasChanged) {\n    return;\n  }\n  notifyConsentListeners();\n  if (result.hasDowngrade) {\n    reloadPage();\n  }\n}\n\nfunction handleGenericConsentActivation(event: Event) {\n  if (!(event instanceof CustomEvent)) {\n    return;\n  }\n  const result = genericConsentCategorySchema.safeParse(event.detail);\n  if (!result.success || categories[result.data]) {\n    return;\n  }\n  categories = { ...categories, [result.data]: true };\n  decidedAt = Date.now();\n  notifyConsentListeners();\n}\n\n/** Inline marker a generic CMP executes when it releases one consent category. */\nexport function buildGrantMarker(\n  category: OptionalConsentCategory,\n): ScriptTagDescriptor {\n  return {\n    kind: \"inline\",\n    body: `document.dispatchEvent(new CustomEvent(${JSON.stringify(GENERIC_CONSENT_GRANTED_EVENT)}, { detail: ${JSON.stringify(category)} }));`,\n  };\n}\n\n/** Latches the platform as the consent backend; un-delegating would need a reload, as native revocation already does. */\nexport function enableConsentDelegation(config: ConsentPlatformConfig) {\n  // Client-only: script gating is a DOM concern, and latching module state\n  // during SSR would leak the config across requests in a Worker isolate.\n  if (typeof window === \"undefined\" || delegatedPlatform) {\n    return;\n  }\n  delegatedPlatform = config;\n  if (config.isCookiebot && !listeningToCookiebot) {\n    listeningToCookiebot = true;\n    for (const event of COOKIEBOT_EVENTS) {\n      window.addEventListener(event, handleCookiebotEvent);\n    }\n  }\n  if (!config.isCookiebot && !listeningToGenericPlatform) {\n    listeningToGenericPlatform = true;\n    document.addEventListener(\n      GENERIC_CONSENT_GRANTED_EVENT,\n      handleGenericConsentActivation,\n    );\n  }\n  if (config.isCookiebot) {\n    // No notify: this runs during render, where notifying re-renders other components.\n    readCookiebotConsent();\n  }\n}\n\n/** Cookiebot-only re-scan; other platforms rely on the loader injecting after every tag. */\nexport function activateBlockedScripts() {\n  if (!delegatedPlatform?.isCookiebot) {\n    return;\n  }\n  window.Cookiebot?.runScripts?.();\n}\n\n/** Subscribe to delegated-consent changes. Returns an unsubscribe function. */\nexport function subscribeToConsentDelegation(listener: () => void): () => void {\n  listeners.add(listener);\n  return () => {\n    listeners.delete(listener);\n  };\n}\n\n/** Replaces navigation in tests so withdrawal behavior can be asserted. */\nexport function setConsentPlatformReloadForTests(reload: () => void) {\n  reloadPage = reload;\n}\n\n/** Test-only reset; leaves subscriptions alone so the store's own stays attached. */\nexport function resetConsentPlatformForTests() {\n  if (typeof window !== \"undefined\" && listeningToCookiebot) {\n    for (const event of COOKIEBOT_EVENTS) {\n      window.removeEventListener(event, handleCookiebotEvent);\n    }\n  }\n  if (typeof document !== \"undefined\" && listeningToGenericPlatform) {\n    document.removeEventListener(\n      GENERIC_CONSENT_GRANTED_EVENT,\n      handleGenericConsentActivation,\n    );\n  }\n  delegatedPlatform = null;\n  listeningToCookiebot = false;\n  listeningToGenericPlatform = false;\n  categories = DENIED_CATEGORIES;\n  decidedAt = null;\n  reloadPage = reloadCurrentPage;\n}\n"],
+  "mappings": "AAOA,SAAS,SAAS;AAElB,SAAS,yBAAyB;AAiBlC,MAAM,gCACJ;AAAA,EACE,WAAW;AAAA,EACX,WAAW;AAAA,EACX,aAAa;AAAA,EACb,cAAc;AAChB;AAEF,SAAS,gBAAgB,YAA2C;AAClE,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,QAAQ;AAAA,MACN;AAAA,QACE,MAAM;AAAA,QACN,KAAK;AAAA,QACL,YAAY;AAAA,UACV,IAAI;AAAA,UACJ,aAAa;AAAA;AAAA;AAAA,QAGf;AAAA,MACF;AAAA,IACF;AAAA,IACA,mBAAmB;AAAA,MACjB,MAAM;AAAA,MACN,QAAQ;AAAA,IACV;AAAA,IACA,aAAa;AAAA,EACf;AACF;AAGO,SAAS,uBAAuB,OAAkC;AACvE,SAAO,MAAM,SAAS,eAAe,MAAM,SAAS;AACtD;AAGO,SAAS,oBACd,SAC8B;AAC9B,aAAW,SAAS,SAAS;AAC3B,QAAI,MAAM,SAAS,aAAa;AAC9B,aAAO,gBAAgB,MAAM,UAAU;AAAA,IACzC;AACA,QAAI,MAAM,SAAS,mBAAmB;AACpC,aAAO;AAAA,QACL,IAAI,MAAM;AAAA,QACV,QAAQ;AAAA,UACN,EAAE,MAAM,YAAY,KAAK,MAAM,KAAK,YAAY,MAAM,WAAW;AAAA,QACnE;AAAA,QACA,mBAAmB,MAAM;AAAA,QACzB,aAAa;AAAA,MACf;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,sBACd,QACA,iBACwB;AACxB,QAAM,QAAQ,gBAAgB,OAAO,CAAC,aAAa,aAAa,WAAW;AAC3E,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO,CAAC;AAAA,EACV;AACA,QAAM,SAAS;AAAA,IACb,GAAG,IAAI;AAAA,MACL,MAAM;AAAA,QACJ,CAAC,aAAa,OAAO,kBAAkB,OAAO,QAAQ,KAAK,CAAC;AAAA,MAC9D;AAAA,IACF;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,GAAI,OAAO,SAAS,IAChB,EAAE,CAAC,OAAO,kBAAkB,IAAI,GAAG,OAAO,KAAK,GAAG,EAAE,IACpD,CAAC;AAAA,EACP;AACF;AAsBA,MAAM,mBAAmB;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AACF;AAIO,MAAM,8BAA8B;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,MAAM,+BAA+B,EAAE,KAAK,2BAA2B;AACvE,MAAM,gCAAgC;AAEtC,IAAI,oBAAkD;AACtD,IAAI,uBAAuB;AAC3B,IAAI,6BAA6B;AACjC,IAAI,aAAgC;AACpC,IAAI,YAA2B;AAC/B,MAAM,YAAY,oBAAI,IAAgB;AACtC,MAAM,oBAAoB,MAAM,OAAO,SAAS,OAAO;AACvD,IAAI,aAAa;AAGV,SAAS,wBAAsD;AACpE,SAAO;AACT;AAGO,SAAS,sBAGd;AACA,SAAO,EAAE,YAAY,UAAU;AACjC;AAQA,SAAS,uBAAmD;AAC1D,QAAM,YACJ,OAAO,WAAW,cAAc,SAAY,OAAO;AACrD,MAAI,CAAC,WAAW,WAAW,UAAU,gBAAgB,MAAM;AACzD,WAAO,EAAE,YAAY,OAAO,cAAc,MAAM;AAAA,EAClD;AACA,QAAM,UAAU,UAAU;AAC1B,QAAM,OAA0B;AAAA,IAC9B,WAAW;AAAA,IACX,WAAW,QAAQ,eAAe;AAAA,IAClC,WAAW,QAAQ,cAAc;AAAA,IACjC,aAAa,QAAQ,gBAAgB;AAAA,IACrC,cAAc,QAAQ,cAAc;AAAA,EACtC;AAEA,QAAM,YACJ,KAAK,cAAc,WAAW,aAC9B,KAAK,cAAc,WAAW,aAC9B,KAAK,gBAAgB,WAAW,eAChC,KAAK,iBAAiB,WAAW;AACnC,MAAI,cAAc,QAAQ,WAAW;AACnC,WAAO,EAAE,YAAY,OAAO,cAAc,MAAM;AAAA,EAClD;AACA,QAAM,eACJ,cAAc,QACd,4BAA4B,KAAK,CAAC,aAAa;AAC7C,WAAO,WAAW,QAAQ,KAAK,CAAC,KAAK,QAAQ;AAAA,EAC/C,CAAC;AACH,eAAa;AACb,cAAY,KAAK,IAAI;AACrB,SAAO,EAAE,YAAY,MAAM,aAAa;AAC1C;AAEA,SAAS,yBAAyB;AAChC,aAAW,YAAY,WAAW;AAChC,aAAS;AAAA,EACX;AACF;AAEA,SAAS,uBAAuB;AAC9B,QAAM,SAAS,qBAAqB;AACpC,MAAI,CAAC,OAAO,YAAY;AACtB;AAAA,EACF;AACA,yBAAuB;AACvB,MAAI,OAAO,cAAc;AACvB,eAAW;AAAA,EACb;AACF;AAEA,SAAS,+BAA+B,OAAc;AACpD,MAAI,EAAE,iBAAiB,cAAc;AACnC;AAAA,EACF;AACA,QAAM,SAAS,6BAA6B,UAAU,MAAM,MAAM;AAClE,MAAI,CAAC,OAAO,WAAW,WAAW,OAAO,IAAI,GAAG;AAC9C;AAAA,EACF;AACA,eAAa,EAAE,GAAG,YAAY,CAAC,OAAO,IAAI,GAAG,KAAK;AAClD,cAAY,KAAK,IAAI;AACrB,yBAAuB;AACzB;AAGO,SAAS,iBACd,UACqB;AACrB,SAAO;AAAA,IACL,MAAM;AAAA,IACN,MAAM,0CAA0C,KAAK,UAAU,6BAA6B,CAAC,eAAe,KAAK,UAAU,QAAQ,CAAC;AAAA,EACtI;AACF;AAGO,SAAS,wBAAwB,QAA+B;AAGrE,MAAI,OAAO,WAAW,eAAe,mBAAmB;AACtD;AAAA,EACF;AACA,sBAAoB;AACpB,MAAI,OAAO,eAAe,CAAC,sBAAsB;AAC/C,2BAAuB;AACvB,eAAW,SAAS,kBAAkB;AACpC,aAAO,iBAAiB,OAAO,oBAAoB;AAAA,IACrD;AAAA,EACF;AACA,MAAI,CAAC,OAAO,eAAe,CAAC,4BAA4B;AACtD,iCAA6B;AAC7B,aAAS;AAAA,MACP;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,aAAa;AAEtB,yBAAqB;AAAA,EACvB;AACF;AAGO,SAAS,yBAAyB;AACvC,MAAI,CAAC,mBAAmB,aAAa;AACnC;AAAA,EACF;AACA,SAAO,WAAW,aAAa;AACjC;AAGO,SAAS,6BAA6B,UAAkC;AAC7E,YAAU,IAAI,QAAQ;AACtB,SAAO,MAAM;AACX,cAAU,OAAO,QAAQ;AAAA,EAC3B;AACF;AAGO,SAAS,iCAAiC,QAAoB;AACnE,eAAa;AACf;AAGO,SAAS,+BAA+B;AAC7C,MAAI,OAAO,WAAW,eAAe,sBAAsB;AACzD,eAAW,SAAS,kBAAkB;AACpC,aAAO,oBAAoB,OAAO,oBAAoB;AAAA,IACxD;AAAA,EACF;AACA,MAAI,OAAO,aAAa,eAAe,4BAA4B;AACjE,aAAS;AAAA,MACP;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,sBAAoB;AACpB,yBAAuB;AACvB,+BAA6B;AAC7B,eAAa;AACb,cAAY;AACZ,eAAa;AACf;",
+  "names": []
+}

package/consent/consent-store.d.ts

@@ -13,6 +13,8 @@ import type { ConsentCategories } from "./cookie";
  * attribute on `<html>`.
  */
 export interface ConsentState {
+    /** Which platform owns consent. Absent means Replo's native banner; "external" is a generic `consentPlatform` entry. */
+    cmp?: "replo" | "cookiebot" | "external";
     mode: ConsentMode;
     categories: ConsentCategories;
     /** Epoch ms when the visitor last made a choice, or null if undecided. */
@@ -59,9 +61,8 @@ export interface UseConsentResult extends ConsentState {
 }
 export declare function useConsent(options?: UseConsentOptions): UseConsentResult;
 /**
- * Whether a script requiring `requiredConsent` is allowed to load right now.
- * `mode === "off"` always allows; otherwise every required category must be
- * granted. An empty requirement list is always allowed.
+ * Whether a script requiring `requiredConsent` may load now. `mode === "off"`
+ * allows everything only under Replo's banner; a delegated CMP answers instead.
  */
 export declare function isConsentAllowed({ state, requiredConsent, }: {
     state: ConsentState;

package/consent/consent-store.js

@@ -2,6 +2,12 @@
 import { useSyncExternalStore } from "react";
 import { deriveConsentAction } from "./consent-action";
 import { recordConsentAction } from "./consent-actions";
+import {
+  findDelegatedPlatform,
+  getDelegatedConsent,
+  OPTIONAL_CONSENT_CATEGORIES,
+  subscribeToConsentDelegation
+} from "./consent-platform";
 import {
   CONSENT_COOKIE_MAX_AGE_SECONDS,
   CONSENT_COOKIE_NAME,
@@ -10,13 +16,8 @@ import {
   parseConsentCookie,
   serializeConsentCookieValue
 } from "./cookie";
-const TOGGLEABLE_CATEGORIES = [
-  "analytics",
-  "marketing",
-  "preferences",
-  "sale_of_data"
-];
 const SERVER_SNAPSHOT = Object.freeze({
+  cmp: "replo",
   mode: "off",
   categories: DENIED_CATEGORIES,
   decidedAt: null
@@ -39,9 +40,18 @@ function computeSnapshot() {
     return SERVER_SNAPSHOT;
   }
   const mode = resolveMode();
+  const platform = findDelegatedPlatform();
+  if (platform) {
+    return {
+      cmp: platform.isCookiebot ? "cookiebot" : "external",
+      mode,
+      ...getDelegatedConsent()
+    };
+  }
   const fromCookie = parseConsentCookie(document.cookie);
   if (fromCookie) {
     return {
+      cmp: "replo",
       mode,
       categories: {
         necessary: true,
@@ -54,7 +64,7 @@ function computeSnapshot() {
       consentId: fromCookie.consentId
     };
   }
-  return { mode, categories: DENIED_CATEGORIES, decidedAt: null };
+  return { cmp: "replo", mode, categories: DENIED_CATEGORIES, decidedAt: null };
 }
 function writeCookie(categories, decidedAt, consentId) {
   if (typeof document === "undefined") {
@@ -77,6 +87,9 @@ function commit({
   policyVersion = DEFAULT_CONSENT_POLICY_VERSION
 }) {
   const previous = consentStore.getSnapshot();
+  if (previous.cmp === "cookiebot" || previous.cmp === "external") {
+    return;
+  }
   const decidedAt = Date.now();
   const consentId = previous.consentId ?? crypto.randomUUID();
   const resultingCategories = {
@@ -85,13 +98,14 @@ function commit({
   };
   writeCookie(categories, decidedAt, consentId);
   snapshot = {
+    cmp: previous.cmp,
     mode: previous.mode,
     categories: resultingCategories,
     decidedAt,
     consentId
   };
   notify();
-  const wasDowngrade = previous.decidedAt !== null && TOGGLEABLE_CATEGORIES.some((category) => {
+  const wasDowngrade = previous.decidedAt !== null && OPTIONAL_CONSENT_CATEGORIES.some((category) => {
     return previous.categories[category] && !categories[category];
   });
   const reloadIfDowngraded = () => {
@@ -114,7 +128,7 @@ function commit({
 }
 const consentStore = {
   getSnapshot() {
-    if (!snapshot) {
+    if (!snapshot || findDelegatedPlatform() !== null && (snapshot.cmp ?? "replo") === "replo") {
       snapshot = computeSnapshot();
     }
     return snapshot;
@@ -178,7 +192,7 @@ function isConsentAllowed({
   state,
   requiredConsent
 }) {
-  if (state.mode === "off") {
+  if (state.cmp !== "cookiebot" && state.cmp !== "external" && state.mode === "off") {
     return true;
   }
   if (requiredConsent.length === 0) {
@@ -186,6 +200,10 @@ function isConsentAllowed({
   }
   return requiredConsent.every((category) => state.categories[category]);
 }
+subscribeToConsentDelegation(() => {
+  snapshot = null;
+  notify();
+});
 export {
   consentStore,
   isConsentAllowed,

package/consent/consent-store.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../consent/consent-store.ts"],
-  "sourcesContent": ["\"use client\";\n\nimport type { ConsentCategory, ConsentMode } from \"schemas/generated/consent\";\nimport type { ConsentCategories } from \"./cookie\";\n\nimport { useSyncExternalStore } from \"react\";\n\nimport { deriveConsentAction } from \"./consent-action\";\nimport { recordConsentAction } from \"./consent-actions\";\nimport {\n  CONSENT_COOKIE_MAX_AGE_SECONDS,\n  CONSENT_COOKIE_NAME,\n  DENIED_CATEGORIES,\n  GRANTED_CATEGORIES,\n  parseConsentCookie,\n  serializeConsentCookieValue,\n} from \"./cookie\";\n\n/**\n * Framework-agnostic, cookie-backed consent store. Lives as a single module\n * singleton so `ReploScripts`, the site's consent banner, and `AnalyticsProvider`\n * all share the same state regardless of where they sit in the React tree \u2014 no\n * provider-ancestor relationship is required.\n *\n * Consent-dependent work (script injection, banner visibility) happens on the\n * client (effects / post-mount), so there is no SSR/hydration mismatch. The\n * client reads the (non-httpOnly) consent cookie directly, so no server seed is\n * needed. The whole-site `mode` comes from the `data-replo-consent-mode`\n * attribute on `<html>`.\n */\n\nexport interface ConsentState {\n  mode: ConsentMode;\n  categories: ConsentCategories;\n  /** Epoch ms when the visitor last made a choice, or null if undecided. */\n  decidedAt: number | null;\n  /**\n   * Persistent pseudonymous per-browser id linking a visitor's consent history.\n   * Absent until the first `commit()` (and on legacy pre-id cookies, until the\n   * next interaction lazily backfills it).\n   */\n  consentId?: string;\n}\n\n// The non-necessary categories a visitor can grant or revoke. `necessary` is\n// always granted and never toggled.\nconst TOGGLEABLE_CATEGORIES: Exclude<ConsentCategory, \"necessary\">[] = [\n  \"analytics\",\n  \"marketing\",\n  \"preferences\",\n  \"sale_of_data\",\n];\n\n// A stable reference for SSR / first hydration render. Consent-dependent DOM is\n// only produced on the client, so this constant never causes a mismatch.\nconst SERVER_SNAPSHOT: ConsentState = Object.freeze({\n  mode: \"off\",\n  categories: DENIED_CATEGORIES,\n  decidedAt: null,\n});\n\nconst listeners = new Set<() => void>();\nlet snapshot: ConsentState | null = null;\n\nfunction isConsentMode(value: string | null | undefined): value is ConsentMode {\n  return value === \"off\" || value === \"simple\" || value === \"per-category\";\n}\n\nfunction resolveMode(): ConsentMode {\n  if (typeof window === \"undefined\") {\n    return \"off\";\n  }\n  const attribute = document.documentElement.dataset.reploConsentMode;\n  return isConsentMode(attribute) ? attribute : \"off\";\n}\n\n// Used when the consent caller doesn't declare a policy version via\n// `useConsent({ version })` or the store method options.\nconst DEFAULT_CONSENT_POLICY_VERSION = 1;\n\nfunction computeSnapshot(): ConsentState {\n  if (typeof window === \"undefined\") {\n    return SERVER_SNAPSHOT;\n  }\n\n  const mode = resolveMode();\n\n  const fromCookie = parseConsentCookie(document.cookie);\n  if (fromCookie) {\n    return {\n      mode,\n      categories: {\n        necessary: true,\n        analytics: fromCookie.categories.analytics,\n        marketing: fromCookie.categories.marketing,\n        preferences: fromCookie.categories.preferences,\n        sale_of_data: fromCookie.categories.sale_of_data,\n      },\n      decidedAt: fromCookie.decidedAt,\n      consentId: fromCookie.consentId,\n    };\n  }\n\n  return { mode, categories: DENIED_CATEGORIES, decidedAt: null };\n}\n\nfunction writeCookie(\n  categories: ConsentCategories,\n  decidedAt: number,\n  consentId: string,\n) {\n  if (typeof document === \"undefined\") {\n    return;\n  }\n  const value = serializeConsentCookieValue({\n    categories,\n    decidedAt,\n    consentId,\n  });\n  document.cookie = `${CONSENT_COOKIE_NAME}=${value}; path=/; max-age=${CONSENT_COOKIE_MAX_AGE_SECONDS}; SameSite=Lax`;\n}\n\nfunction notify() {\n  for (const listener of listeners) {\n    listener();\n  }\n}\n\nfunction commit({\n  categories,\n  policyVersion = DEFAULT_CONSENT_POLICY_VERSION,\n}: {\n  categories: ConsentCategories;\n  policyVersion?: number;\n}) {\n  const previous = consentStore.getSnapshot();\n  const decidedAt = Date.now();\n  // Reuse the visitor's existing id, or mint one on the first decision (also\n  // lazily backfills legacy pre-id cookies). `crypto.randomUUID` is available in\n  // every browser we target and on the server (where commit() never runs).\n  const consentId = previous.consentId ?? crypto.randomUUID();\n  const resultingCategories: ConsentCategories = {\n    ...categories,\n    necessary: true,\n  };\n  writeCookie(categories, decidedAt, consentId);\n  snapshot = {\n    mode: previous.mode,\n    categories: resultingCategories,\n    decidedAt,\n    consentId,\n  };\n  notify();\n\n  // Revocation cannot unload an already-loaded vendor. If the visitor had\n  // previously decided and is now turning a granted category off, reload so the\n  // page renders without those scripts. Deferred until after the audit record is\n  // sent so the reload doesn't cancel the in-flight server action.\n  const wasDowngrade =\n    previous.decidedAt !== null &&\n    TOGGLEABLE_CATEGORIES.some((category) => {\n      return previous.categories[category] && !categories[category];\n    });\n  const reloadIfDowngraded = () => {\n    if (wasDowngrade && typeof window !== \"undefined\") {\n      window.location.reload();\n    }\n  };\n\n  // Proof-of-consent audit record (ungated by consent, but only on managed\n  // sites). On `mode === \"off\"` there is no banner/consent UX, so a\n  // `setTrackingConsent()` call from a third-party script would only produce\n  // meaningless `consent_mode: \"off\"` noise \u2014 skip it. Egress runs through a\n  // server action (like the cart) so the client never needs the project id or\n  // analytics-fire URL.\n  if (previous.mode !== \"off\") {\n    void recordConsentAction({\n      consentId,\n      action: deriveConsentAction({ previous, next: resultingCategories }),\n      categories: resultingCategories,\n      consentMode: previous.mode,\n      decidedAt,\n      policyVersion,\n    }).finally(reloadIfDowngraded);\n  } else {\n    reloadIfDowngraded();\n  }\n}\n\nexport const consentStore = {\n  getSnapshot(): ConsentState {\n    if (!snapshot) {\n      snapshot = computeSnapshot();\n    }\n    return snapshot;\n  },\n  getServerSnapshot(): ConsentState {\n    return SERVER_SNAPSHOT;\n  },\n  subscribe(listener: () => void): () => void {\n    listeners.add(listener);\n    return () => {\n      listeners.delete(listener);\n    };\n  },\n  /** Grant every consent category. */\n  accept(options: { policyVersion?: number } = {}) {\n    commit({\n      categories: GRANTED_CATEGORIES,\n      policyVersion: options.policyVersion,\n    });\n  },\n  /** Deny every non-necessary category. */\n  reject(options: { policyVersion?: number } = {}) {\n    commit({\n      categories: DENIED_CATEGORIES,\n      policyVersion: options.policyVersion,\n    });\n  },\n  /** Set a subset of categories, leaving the rest at their current value. */\n  updateCategories({\n    next,\n    policyVersion,\n  }: {\n    next: Partial<ConsentCategories>;\n    policyVersion?: number;\n  }) {\n    const current = consentStore.getSnapshot().categories;\n    commit({\n      categories: { ...current, ...next, necessary: true },\n      policyVersion,\n    });\n  },\n  /** Test-only: reset cached state so the next read recomputes. */\n  reset() {\n    snapshot = null;\n  },\n};\n\nexport interface UseConsentOptions {\n  /**\n   * Site-owned consent policy version, stamped onto each proof-of-consent\n   * record so a decision can be tied to the exact banner the visitor saw.\n   * Bump it whenever the banner copy or category set changes. Defaults to 1.\n   */\n  version?: number;\n}\n\nexport interface UseConsentResult extends ConsentState {\n  accept(): void;\n  reject(): void;\n  updateCategories(next: Partial<ConsentCategories>): void;\n}\n\nexport function useConsent(options: UseConsentOptions = {}): UseConsentResult {\n  const policyVersion = options.version;\n  const state = useSyncExternalStore(\n    consentStore.subscribe,\n    consentStore.getSnapshot,\n    consentStore.getServerSnapshot,\n  );\n  return {\n    ...state,\n    accept: () => consentStore.accept({ policyVersion }),\n    reject: () => consentStore.reject({ policyVersion }),\n    updateCategories: (next) => {\n      consentStore.updateCategories({ next, policyVersion });\n    },\n  };\n}\n\n/**\n * Whether a script requiring `requiredConsent` is allowed to load right now.\n * `mode === \"off\"` always allows; otherwise every required category must be\n * granted. An empty requirement list is always allowed.\n */\nexport function isConsentAllowed({\n  state,\n  requiredConsent,\n}: {\n  state: ConsentState;\n  requiredConsent: ConsentCategory[];\n}): boolean {\n  if (state.mode === \"off\") {\n    return true;\n  }\n  if (requiredConsent.length === 0) {\n    return true;\n  }\n  return requiredConsent.every((category) => state.categories[category]);\n}\n"],
-  "mappings": ";AAKA,SAAS,4BAA4B;AAErC,SAAS,2BAA2B;AACpC,SAAS,2BAA2B;AACpC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA8BP,MAAM,wBAAiE;AAAA,EACrE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAIA,MAAM,kBAAgC,OAAO,OAAO;AAAA,EAClD,MAAM;AAAA,EACN,YAAY;AAAA,EACZ,WAAW;AACb,CAAC;AAED,MAAM,YAAY,oBAAI,IAAgB;AACtC,IAAI,WAAgC;AAEpC,SAAS,cAAc,OAAwD;AAC7E,SAAO,UAAU,SAAS,UAAU,YAAY,UAAU;AAC5D;AAEA,SAAS,cAA2B;AAClC,MAAI,OAAO,WAAW,aAAa;AACjC,WAAO;AAAA,EACT;AACA,QAAM,YAAY,SAAS,gBAAgB,QAAQ;AACnD,SAAO,cAAc,SAAS,IAAI,YAAY;AAChD;AAIA,MAAM,iCAAiC;AAEvC,SAAS,kBAAgC;AACvC,MAAI,OAAO,WAAW,aAAa;AACjC,WAAO;AAAA,EACT;AAEA,QAAM,OAAO,YAAY;AAEzB,QAAM,aAAa,mBAAmB,SAAS,MAAM;AACrD,MAAI,YAAY;AACd,WAAO;AAAA,MACL;AAAA,MACA,YAAY;AAAA,QACV,WAAW;AAAA,QACX,WAAW,WAAW,WAAW;AAAA,QACjC,WAAW,WAAW,WAAW;AAAA,QACjC,aAAa,WAAW,WAAW;AAAA,QACnC,cAAc,WAAW,WAAW;AAAA,MACtC;AAAA,MACA,WAAW,WAAW;AAAA,MACtB,WAAW,WAAW;AAAA,IACxB;AAAA,EACF;AAEA,SAAO,EAAE,MAAM,YAAY,mBAAmB,WAAW,KAAK;AAChE;AAEA,SAAS,YACP,YACA,WACA,WACA;AACA,MAAI,OAAO,aAAa,aAAa;AACnC;AAAA,EACF;AACA,QAAM,QAAQ,4BAA4B;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,WAAS,SAAS,GAAG,mBAAmB,IAAI,KAAK,qBAAqB,8BAA8B;AACtG;AAEA,SAAS,SAAS;AAChB,aAAW,YAAY,WAAW;AAChC,aAAS;AAAA,EACX;AACF;AAEA,SAAS,OAAO;AAAA,EACd;AAAA,EACA,gBAAgB;AAClB,GAGG;AACD,QAAM,WAAW,aAAa,YAAY;AAC1C,QAAM,YAAY,KAAK,IAAI;AAI3B,QAAM,YAAY,SAAS,aAAa,OAAO,WAAW;AAC1D,QAAM,sBAAyC;AAAA,IAC7C,GAAG;AAAA,IACH,WAAW;AAAA,EACb;AACA,cAAY,YAAY,WAAW,SAAS;AAC5C,aAAW;AAAA,IACT,MAAM,SAAS;AAAA,IACf,YAAY;AAAA,IACZ;AAAA,IACA;AAAA,EACF;AACA,SAAO;AAMP,QAAM,eACJ,SAAS,cAAc,QACvB,sBAAsB,KAAK,CAAC,aAAa;AACvC,WAAO,SAAS,WAAW,QAAQ,KAAK,CAAC,WAAW,QAAQ;AAAA,EAC9D,CAAC;AACH,QAAM,qBAAqB,MAAM;AAC/B,QAAI,gBAAgB,OAAO,WAAW,aAAa;AACjD,aAAO,SAAS,OAAO;AAAA,IACzB;AAAA,EACF;AAQA,MAAI,SAAS,SAAS,OAAO;AAC3B,SAAK,oBAAoB;AAAA,MACvB;AAAA,MACA,QAAQ,oBAAoB,EAAE,UAAU,MAAM,oBAAoB,CAAC;AAAA,MACnE,YAAY;AAAA,MACZ,aAAa,SAAS;AAAA,MACtB;AAAA,MACA;AAAA,IACF,CAAC,EAAE,QAAQ,kBAAkB;AAAA,EAC/B,OAAO;AACL,uBAAmB;AAAA,EACrB;AACF;AAEO,MAAM,eAAe;AAAA,EAC1B,cAA4B;AAC1B,QAAI,CAAC,UAAU;AACb,iBAAW,gBAAgB;AAAA,IAC7B;AACA,WAAO;AAAA,EACT;AAAA,EACA,oBAAkC;AAChC,WAAO;AAAA,EACT;AAAA,EACA,UAAU,UAAkC;AAC1C,cAAU,IAAI,QAAQ;AACtB,WAAO,MAAM;AACX,gBAAU,OAAO,QAAQ;AAAA,IAC3B;AAAA,EACF;AAAA;AAAA,EAEA,OAAO,UAAsC,CAAC,GAAG;AAC/C,WAAO;AAAA,MACL,YAAY;AAAA,MACZ,eAAe,QAAQ;AAAA,IACzB,CAAC;AAAA,EACH;AAAA;AAAA,EAEA,OAAO,UAAsC,CAAC,GAAG;AAC/C,WAAO;AAAA,MACL,YAAY;AAAA,MACZ,eAAe,QAAQ;AAAA,IACzB,CAAC;AAAA,EACH;AAAA;AAAA,EAEA,iBAAiB;AAAA,IACf;AAAA,IACA;AAAA,EACF,GAGG;AACD,UAAM,UAAU,aAAa,YAAY,EAAE;AAC3C,WAAO;AAAA,MACL,YAAY,EAAE,GAAG,SAAS,GAAG,MAAM,WAAW,KAAK;AAAA,MACnD;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA,EAEA,QAAQ;AACN,eAAW;AAAA,EACb;AACF;AAiBO,SAAS,WAAW,UAA6B,CAAC,GAAqB;AAC5E,QAAM,gBAAgB,QAAQ;AAC9B,QAAM,QAAQ;AAAA,IACZ,aAAa;AAAA,IACb,aAAa;AAAA,IACb,aAAa;AAAA,EACf;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,QAAQ,MAAM,aAAa,OAAO,EAAE,cAAc,CAAC;AAAA,IACnD,QAAQ,MAAM,aAAa,OAAO,EAAE,cAAc,CAAC;AAAA,IACnD,kBAAkB,CAAC,SAAS;AAC1B,mBAAa,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAAA,IACvD;AAAA,EACF;AACF;AAOO,SAAS,iBAAiB;AAAA,EAC/B;AAAA,EACA;AACF,GAGY;AACV,MAAI,MAAM,SAAS,OAAO;AACxB,WAAO;AAAA,EACT;AACA,MAAI,gBAAgB,WAAW,GAAG;AAChC,WAAO;AAAA,EACT;AACA,SAAO,gBAAgB,MAAM,CAAC,aAAa,MAAM,WAAW,QAAQ,CAAC;AACvE;",
+  "sourcesContent": ["\"use client\";\n\nimport type { ConsentCategory, ConsentMode } from \"schemas/generated/consent\";\nimport type { ConsentCategories } from \"./cookie\";\n\nimport { useSyncExternalStore } from \"react\";\n\nimport { deriveConsentAction } from \"./consent-action\";\nimport { recordConsentAction } from \"./consent-actions\";\nimport {\n  findDelegatedPlatform,\n  getDelegatedConsent,\n  OPTIONAL_CONSENT_CATEGORIES,\n  subscribeToConsentDelegation,\n} from \"./consent-platform\";\nimport {\n  CONSENT_COOKIE_MAX_AGE_SECONDS,\n  CONSENT_COOKIE_NAME,\n  DENIED_CATEGORIES,\n  GRANTED_CATEGORIES,\n  parseConsentCookie,\n  serializeConsentCookieValue,\n} from \"./cookie\";\n\n/**\n * Framework-agnostic, cookie-backed consent store. Lives as a single module\n * singleton so `ReploScripts`, the site's consent banner, and `AnalyticsProvider`\n * all share the same state regardless of where they sit in the React tree \u2014 no\n * provider-ancestor relationship is required.\n *\n * Consent-dependent work (script injection, banner visibility) happens on the\n * client (effects / post-mount), so there is no SSR/hydration mismatch. The\n * client reads the (non-httpOnly) consent cookie directly, so no server seed is\n * needed. The whole-site `mode` comes from the `data-replo-consent-mode`\n * attribute on `<html>`.\n */\n\nexport interface ConsentState {\n  /** Which platform owns consent. Absent means Replo's native banner; \"external\" is a generic `consentPlatform` entry. */\n  cmp?: \"replo\" | \"cookiebot\" | \"external\";\n  mode: ConsentMode;\n  categories: ConsentCategories;\n  /** Epoch ms when the visitor last made a choice, or null if undecided. */\n  decidedAt: number | null;\n  /**\n   * Persistent pseudonymous per-browser id linking a visitor's consent history.\n   * Absent until the first `commit()` (and on legacy pre-id cookies, until the\n   * next interaction lazily backfills it).\n   */\n  consentId?: string;\n}\n\n// A stable reference for SSR / first hydration render. Consent-dependent DOM is\n// only produced on the client, so this constant never causes a mismatch.\nconst SERVER_SNAPSHOT: ConsentState = Object.freeze({\n  cmp: \"replo\",\n  mode: \"off\",\n  categories: DENIED_CATEGORIES,\n  decidedAt: null,\n});\n\nconst listeners = new Set<() => void>();\nlet snapshot: ConsentState | null = null;\n\nfunction isConsentMode(value: string | null | undefined): value is ConsentMode {\n  return value === \"off\" || value === \"simple\" || value === \"per-category\";\n}\n\nfunction resolveMode(): ConsentMode {\n  if (typeof window === \"undefined\") {\n    return \"off\";\n  }\n  const attribute = document.documentElement.dataset.reploConsentMode;\n  return isConsentMode(attribute) ? attribute : \"off\";\n}\n\n// Used when the consent caller doesn't declare a policy version via\n// `useConsent({ version })` or the store method options.\nconst DEFAULT_CONSENT_POLICY_VERSION = 1;\n\nfunction computeSnapshot(): ConsentState {\n  if (typeof window === \"undefined\") {\n    return SERVER_SNAPSHOT;\n  }\n\n  const mode = resolveMode();\n\n  // Delegated sites turn the native banner off, so `mode` alone would allow everything.\n  const platform = findDelegatedPlatform();\n  if (platform) {\n    return {\n      cmp: platform.isCookiebot ? \"cookiebot\" : \"external\",\n      mode,\n      ...getDelegatedConsent(),\n    };\n  }\n\n  const fromCookie = parseConsentCookie(document.cookie);\n  if (fromCookie) {\n    return {\n      cmp: \"replo\",\n      mode,\n      categories: {\n        necessary: true,\n        analytics: fromCookie.categories.analytics,\n        marketing: fromCookie.categories.marketing,\n        preferences: fromCookie.categories.preferences,\n        sale_of_data: fromCookie.categories.sale_of_data,\n      },\n      decidedAt: fromCookie.decidedAt,\n      consentId: fromCookie.consentId,\n    };\n  }\n\n  return { cmp: \"replo\", mode, categories: DENIED_CATEGORIES, decidedAt: null };\n}\n\nfunction writeCookie(\n  categories: ConsentCategories,\n  decidedAt: number,\n  consentId: string,\n) {\n  if (typeof document === \"undefined\") {\n    return;\n  }\n  const value = serializeConsentCookieValue({\n    categories,\n    decidedAt,\n    consentId,\n  });\n  document.cookie = `${CONSENT_COOKIE_NAME}=${value}; path=/; max-age=${CONSENT_COOKIE_MAX_AGE_SECONDS}; SameSite=Lax`;\n}\n\nfunction notify() {\n  for (const listener of listeners) {\n    listener();\n  }\n}\n\nfunction commit({\n  categories,\n  policyVersion = DEFAULT_CONSENT_POLICY_VERSION,\n}: {\n  categories: ConsentCategories;\n  policyVersion?: number;\n}) {\n  const previous = consentStore.getSnapshot();\n  // The platform owns the decision, so a native accept would write a cookie nothing reads.\n  if (previous.cmp === \"cookiebot\" || previous.cmp === \"external\") {\n    return;\n  }\n  const decidedAt = Date.now();\n  // Reuse the visitor's existing id, or mint one on the first decision (also\n  // lazily backfills legacy pre-id cookies). `crypto.randomUUID` is available in\n  // every browser we target and on the server (where commit() never runs).\n  const consentId = previous.consentId ?? crypto.randomUUID();\n  const resultingCategories: ConsentCategories = {\n    ...categories,\n    necessary: true,\n  };\n  writeCookie(categories, decidedAt, consentId);\n  snapshot = {\n    cmp: previous.cmp,\n    mode: previous.mode,\n    categories: resultingCategories,\n    decidedAt,\n    consentId,\n  };\n  notify();\n\n  // Revocation cannot unload an already-loaded vendor. If the visitor had\n  // previously decided and is now turning a granted category off, reload so the\n  // page renders without those scripts. Deferred until after the audit record is\n  // sent so the reload doesn't cancel the in-flight server action.\n  const wasDowngrade =\n    previous.decidedAt !== null &&\n    OPTIONAL_CONSENT_CATEGORIES.some((category) => {\n      return previous.categories[category] && !categories[category];\n    });\n  const reloadIfDowngraded = () => {\n    if (wasDowngrade && typeof window !== \"undefined\") {\n      window.location.reload();\n    }\n  };\n\n  // Proof-of-consent audit record (ungated by consent, but only on managed\n  // sites). On `mode === \"off\"` there is no banner/consent UX, so a\n  // `setTrackingConsent()` call from a third-party script would only produce\n  // meaningless `consent_mode: \"off\"` noise \u2014 skip it. Egress runs through a\n  // server action (like the cart) so the client never needs the project id or\n  // analytics-fire URL.\n  if (previous.mode !== \"off\") {\n    void recordConsentAction({\n      consentId,\n      action: deriveConsentAction({ previous, next: resultingCategories }),\n      categories: resultingCategories,\n      consentMode: previous.mode,\n      decidedAt,\n      policyVersion,\n    }).finally(reloadIfDowngraded);\n  } else {\n    reloadIfDowngraded();\n  }\n}\n\nexport const consentStore = {\n  getSnapshot(): ConsentState {\n    // Delegation is published mid-render, so a snapshot read earlier can predate it.\n    if (\n      !snapshot ||\n      (findDelegatedPlatform() !== null &&\n        (snapshot.cmp ?? \"replo\") === \"replo\")\n    ) {\n      snapshot = computeSnapshot();\n    }\n    return snapshot;\n  },\n  getServerSnapshot(): ConsentState {\n    return SERVER_SNAPSHOT;\n  },\n  subscribe(listener: () => void): () => void {\n    listeners.add(listener);\n    return () => {\n      listeners.delete(listener);\n    };\n  },\n  /** Grant every consent category. */\n  accept(options: { policyVersion?: number } = {}) {\n    commit({\n      categories: GRANTED_CATEGORIES,\n      policyVersion: options.policyVersion,\n    });\n  },\n  /** Deny every non-necessary category. */\n  reject(options: { policyVersion?: number } = {}) {\n    commit({\n      categories: DENIED_CATEGORIES,\n      policyVersion: options.policyVersion,\n    });\n  },\n  /** Set a subset of categories, leaving the rest at their current value. */\n  updateCategories({\n    next,\n    policyVersion,\n  }: {\n    next: Partial<ConsentCategories>;\n    policyVersion?: number;\n  }) {\n    const current = consentStore.getSnapshot().categories;\n    commit({\n      categories: { ...current, ...next, necessary: true },\n      policyVersion,\n    });\n  },\n  /** Test-only: reset cached state so the next read recomputes. */\n  reset() {\n    snapshot = null;\n  },\n};\n\nexport interface UseConsentOptions {\n  /**\n   * Site-owned consent policy version, stamped onto each proof-of-consent\n   * record so a decision can be tied to the exact banner the visitor saw.\n   * Bump it whenever the banner copy or category set changes. Defaults to 1.\n   */\n  version?: number;\n}\n\nexport interface UseConsentResult extends ConsentState {\n  accept(): void;\n  reject(): void;\n  updateCategories(next: Partial<ConsentCategories>): void;\n}\n\nexport function useConsent(options: UseConsentOptions = {}): UseConsentResult {\n  const policyVersion = options.version;\n  const state = useSyncExternalStore(\n    consentStore.subscribe,\n    consentStore.getSnapshot,\n    consentStore.getServerSnapshot,\n  );\n  return {\n    ...state,\n    accept: () => consentStore.accept({ policyVersion }),\n    reject: () => consentStore.reject({ policyVersion }),\n    updateCategories: (next) => {\n      consentStore.updateCategories({ next, policyVersion });\n    },\n  };\n}\n\n/**\n * Whether a script requiring `requiredConsent` may load now. `mode === \"off\"`\n * allows everything only under Replo's banner; a delegated CMP answers instead.\n */\nexport function isConsentAllowed({\n  state,\n  requiredConsent,\n}: {\n  state: ConsentState;\n  requiredConsent: ConsentCategory[];\n}): boolean {\n  if (\n    state.cmp !== \"cookiebot\" &&\n    state.cmp !== \"external\" &&\n    state.mode === \"off\"\n  ) {\n    return true;\n  }\n  if (requiredConsent.length === 0) {\n    return true;\n  }\n  return requiredConsent.every((category) => state.categories[category]);\n}\n\n// The platform answers asynchronously; invalidate so every consent gate re-evaluates.\nsubscribeToConsentDelegation(() => {\n  snapshot = null;\n  notify();\n});\n"],
+  "mappings": ";AAKA,SAAS,4BAA4B;AAErC,SAAS,2BAA2B;AACpC,SAAS,2BAA2B;AACpC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAgCP,MAAM,kBAAgC,OAAO,OAAO;AAAA,EAClD,KAAK;AAAA,EACL,MAAM;AAAA,EACN,YAAY;AAAA,EACZ,WAAW;AACb,CAAC;AAED,MAAM,YAAY,oBAAI,IAAgB;AACtC,IAAI,WAAgC;AAEpC,SAAS,cAAc,OAAwD;AAC7E,SAAO,UAAU,SAAS,UAAU,YAAY,UAAU;AAC5D;AAEA,SAAS,cAA2B;AAClC,MAAI,OAAO,WAAW,aAAa;AACjC,WAAO;AAAA,EACT;AACA,QAAM,YAAY,SAAS,gBAAgB,QAAQ;AACnD,SAAO,cAAc,SAAS,IAAI,YAAY;AAChD;AAIA,MAAM,iCAAiC;AAEvC,SAAS,kBAAgC;AACvC,MAAI,OAAO,WAAW,aAAa;AACjC,WAAO;AAAA,EACT;AAEA,QAAM,OAAO,YAAY;AAGzB,QAAM,WAAW,sBAAsB;AACvC,MAAI,UAAU;AACZ,WAAO;AAAA,MACL,KAAK,SAAS,cAAc,cAAc;AAAA,MAC1C;AAAA,MACA,GAAG,oBAAoB;AAAA,IACzB;AAAA,EACF;AAEA,QAAM,aAAa,mBAAmB,SAAS,MAAM;AACrD,MAAI,YAAY;AACd,WAAO;AAAA,MACL,KAAK;AAAA,MACL;AAAA,MACA,YAAY;AAAA,QACV,WAAW;AAAA,QACX,WAAW,WAAW,WAAW;AAAA,QACjC,WAAW,WAAW,WAAW;AAAA,QACjC,aAAa,WAAW,WAAW;AAAA,QACnC,cAAc,WAAW,WAAW;AAAA,MACtC;AAAA,MACA,WAAW,WAAW;AAAA,MACtB,WAAW,WAAW;AAAA,IACxB;AAAA,EACF;AAEA,SAAO,EAAE,KAAK,SAAS,MAAM,YAAY,mBAAmB,WAAW,KAAK;AAC9E;AAEA,SAAS,YACP,YACA,WACA,WACA;AACA,MAAI,OAAO,aAAa,aAAa;AACnC;AAAA,EACF;AACA,QAAM,QAAQ,4BAA4B;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,WAAS,SAAS,GAAG,mBAAmB,IAAI,KAAK,qBAAqB,8BAA8B;AACtG;AAEA,SAAS,SAAS;AAChB,aAAW,YAAY,WAAW;AAChC,aAAS;AAAA,EACX;AACF;AAEA,SAAS,OAAO;AAAA,EACd;AAAA,EACA,gBAAgB;AAClB,GAGG;AACD,QAAM,WAAW,aAAa,YAAY;AAE1C,MAAI,SAAS,QAAQ,eAAe,SAAS,QAAQ,YAAY;AAC/D;AAAA,EACF;AACA,QAAM,YAAY,KAAK,IAAI;AAI3B,QAAM,YAAY,SAAS,aAAa,OAAO,WAAW;AAC1D,QAAM,sBAAyC;AAAA,IAC7C,GAAG;AAAA,IACH,WAAW;AAAA,EACb;AACA,cAAY,YAAY,WAAW,SAAS;AAC5C,aAAW;AAAA,IACT,KAAK,SAAS;AAAA,IACd,MAAM,SAAS;AAAA,IACf,YAAY;AAAA,IACZ;AAAA,IACA;AAAA,EACF;AACA,SAAO;AAMP,QAAM,eACJ,SAAS,cAAc,QACvB,4BAA4B,KAAK,CAAC,aAAa;AAC7C,WAAO,SAAS,WAAW,QAAQ,KAAK,CAAC,WAAW,QAAQ;AAAA,EAC9D,CAAC;AACH,QAAM,qBAAqB,MAAM;AAC/B,QAAI,gBAAgB,OAAO,WAAW,aAAa;AACjD,aAAO,SAAS,OAAO;AAAA,IACzB;AAAA,EACF;AAQA,MAAI,SAAS,SAAS,OAAO;AAC3B,SAAK,oBAAoB;AAAA,MACvB;AAAA,MACA,QAAQ,oBAAoB,EAAE,UAAU,MAAM,oBAAoB,CAAC;AAAA,MACnE,YAAY;AAAA,MACZ,aAAa,SAAS;AAAA,MACtB;AAAA,MACA;AAAA,IACF,CAAC,EAAE,QAAQ,kBAAkB;AAAA,EAC/B,OAAO;AACL,uBAAmB;AAAA,EACrB;AACF;AAEO,MAAM,eAAe;AAAA,EAC1B,cAA4B;AAE1B,QACE,CAAC,YACA,sBAAsB,MAAM,SAC1B,SAAS,OAAO,aAAa,SAChC;AACA,iBAAW,gBAAgB;AAAA,IAC7B;AACA,WAAO;AAAA,EACT;AAAA,EACA,oBAAkC;AAChC,WAAO;AAAA,EACT;AAAA,EACA,UAAU,UAAkC;AAC1C,cAAU,IAAI,QAAQ;AACtB,WAAO,MAAM;AACX,gBAAU,OAAO,QAAQ;AAAA,IAC3B;AAAA,EACF;AAAA;AAAA,EAEA,OAAO,UAAsC,CAAC,GAAG;AAC/C,WAAO;AAAA,MACL,YAAY;AAAA,MACZ,eAAe,QAAQ;AAAA,IACzB,CAAC;AAAA,EACH;AAAA;AAAA,EAEA,OAAO,UAAsC,CAAC,GAAG;AAC/C,WAAO;AAAA,MACL,YAAY;AAAA,MACZ,eAAe,QAAQ;AAAA,IACzB,CAAC;AAAA,EACH;AAAA;AAAA,EAEA,iBAAiB;AAAA,IACf;AAAA,IACA;AAAA,EACF,GAGG;AACD,UAAM,UAAU,aAAa,YAAY,EAAE;AAC3C,WAAO;AAAA,MACL,YAAY,EAAE,GAAG,SAAS,GAAG,MAAM,WAAW,KAAK;AAAA,MACnD;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA,EAEA,QAAQ;AACN,eAAW;AAAA,EACb;AACF;AAiBO,SAAS,WAAW,UAA6B,CAAC,GAAqB;AAC5E,QAAM,gBAAgB,QAAQ;AAC9B,QAAM,QAAQ;AAAA,IACZ,aAAa;AAAA,IACb,aAAa;AAAA,IACb,aAAa;AAAA,EACf;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,QAAQ,MAAM,aAAa,OAAO,EAAE,cAAc,CAAC;AAAA,IACnD,QAAQ,MAAM,aAAa,OAAO,EAAE,cAAc,CAAC;AAAA,IACnD,kBAAkB,CAAC,SAAS;AAC1B,mBAAa,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAAA,IACvD;AAAA,EACF;AACF;AAMO,SAAS,iBAAiB;AAAA,EAC/B;AAAA,EACA;AACF,GAGY;AACV,MACE,MAAM,QAAQ,eACd,MAAM,QAAQ,cACd,MAAM,SAAS,OACf;AACA,WAAO;AAAA,EACT;AACA,MAAI,gBAAgB,WAAW,GAAG;AAChC,WAAO;AAAA,EACT;AACA,SAAO,gBAAgB,MAAM,CAAC,aAAa,MAAM,WAAW,QAAQ,CAAC;AACvE;AAGA,6BAA6B,MAAM;AACjC,aAAW;AACX,SAAO;AACT,CAAC;",
   "names": []
 }

package/consent/inject-script-descriptors.d.ts

@@ -5,7 +5,9 @@ import type { ScriptTagDescriptor } from "../_vendor/schemas/generated/consent";
  * their removal. Lives outside replo-scripts.tsx so the component file only
  * exports components (HMR) and this stays off the published public surface.
  */
-export declare function injectScriptDescriptors({ baseId, descriptors, }: {
+export declare function injectScriptDescriptors({ baseId, descriptors, extraAttributes, }: {
     baseId: string;
     descriptors: ScriptTagDescriptor[];
+    /** Applied last, so a consent platform's `text/plain` beats a descriptor's own type. */
+    extraAttributes?: Record<string, string>;
 }): HTMLScriptElement[];

package/consent/inject-script-descriptors.js

@@ -1,6 +1,7 @@
 function injectScriptDescriptors({
   baseId,
-  descriptors
+  descriptors,
+  extraAttributes
 }) {
   const createdNodes = [];
   descriptors.forEach((descriptor, index) => {
@@ -18,17 +19,32 @@ function injectScriptDescriptors({
       )) {
         scriptElement.setAttribute(attributeName, attributeValue);
       }
+    } else if (descriptor.module && extraAttributes?.type === "text/plain") {
+      scriptElement.textContent = buildModuleShim(descriptor.body);
     } else {
       if (descriptor.module) {
         scriptElement.type = "module";
       }
       scriptElement.textContent = descriptor.body;
     }
+    for (const [attributeName, attributeValue] of Object.entries(
+      extraAttributes ?? {}
+    )) {
+      scriptElement.setAttribute(attributeName, attributeValue);
+    }
     document.head.append(scriptElement);
     createdNodes.push(scriptElement);
   });
   return createdNodes;
 }
+function buildModuleShim(body) {
+  return [
+    'var moduleScript = document.createElement("script");',
+    'moduleScript.type = "module";',
+    `moduleScript.textContent = ${JSON.stringify(body)};`,
+    "document.head.append(moduleScript);"
+  ].join("\n");
+}
 export {
   injectScriptDescriptors
 };

package/consent/inject-script-descriptors.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../consent/inject-script-descriptors.ts"],
-  "sourcesContent": ["import type { ScriptTagDescriptor } from \"schemas/generated/consent\";\n\n/**\n * Creates and appends the script nodes for `descriptors`, skipping node ids\n * already in the document, and returns the created nodes so the caller owns\n * their removal. Lives outside replo-scripts.tsx so the component file only\n * exports components (HMR) and this stays off the published public surface.\n */\nexport function injectScriptDescriptors({\n  baseId,\n  descriptors,\n}: {\n  baseId: string;\n  descriptors: ScriptTagDescriptor[];\n}): HTMLScriptElement[] {\n  const createdNodes: HTMLScriptElement[] = [];\n  descriptors.forEach((descriptor, index) => {\n    const nodeId = `${baseId}#${index}`;\n    if (document.querySelector(`script[data-replo-script-id=\"${nodeId}\"]`)) {\n      return;\n    }\n    const scriptElement = document.createElement(\"script\");\n    scriptElement.dataset.reploScriptId = nodeId;\n    if (descriptor.kind === \"external\") {\n      scriptElement.src = descriptor.src;\n      scriptElement.async = true;\n      for (const [attributeName, attributeValue] of Object.entries(\n        descriptor.attributes ?? {},\n      )) {\n        scriptElement.setAttribute(attributeName, attributeValue);\n      }\n    } else {\n      // Module snippets (top-level await, import()) are a SyntaxError as\n      // classic scripts, so the type must survive injection.\n      if (descriptor.module) {\n        scriptElement.type = \"module\";\n      }\n      scriptElement.textContent = descriptor.body;\n    }\n    document.head.append(scriptElement);\n    createdNodes.push(scriptElement);\n  });\n  return createdNodes;\n}\n"],
-  "mappings": "AAQO,SAAS,wBAAwB;AAAA,EACtC;AAAA,EACA;AACF,GAGwB;AACtB,QAAM,eAAoC,CAAC;AAC3C,cAAY,QAAQ,CAAC,YAAY,UAAU;AACzC,UAAM,SAAS,GAAG,MAAM,IAAI,KAAK;AACjC,QAAI,SAAS,cAAc,gCAAgC,MAAM,IAAI,GAAG;AACtE;AAAA,IACF;AACA,UAAM,gBAAgB,SAAS,cAAc,QAAQ;AACrD,kBAAc,QAAQ,gBAAgB;AACtC,QAAI,WAAW,SAAS,YAAY;AAClC,oBAAc,MAAM,WAAW;AAC/B,oBAAc,QAAQ;AACtB,iBAAW,CAAC,eAAe,cAAc,KAAK,OAAO;AAAA,QACnD,WAAW,cAAc,CAAC;AAAA,MAC5B,GAAG;AACD,sBAAc,aAAa,eAAe,cAAc;AAAA,MAC1D;AAAA,IACF,OAAO;AAGL,UAAI,WAAW,QAAQ;AACrB,sBAAc,OAAO;AAAA,MACvB;AACA,oBAAc,cAAc,WAAW;AAAA,IACzC;AACA,aAAS,KAAK,OAAO,aAAa;AAClC,iBAAa,KAAK,aAAa;AAAA,EACjC,CAAC;AACD,SAAO;AACT;",
+  "sourcesContent": ["import type { ScriptTagDescriptor } from \"schemas/generated/consent\";\n\n/**\n * Creates and appends the script nodes for `descriptors`, skipping node ids\n * already in the document, and returns the created nodes so the caller owns\n * their removal. Lives outside replo-scripts.tsx so the component file only\n * exports components (HMR) and this stays off the published public surface.\n */\nexport function injectScriptDescriptors({\n  baseId,\n  descriptors,\n  extraAttributes,\n}: {\n  baseId: string;\n  descriptors: ScriptTagDescriptor[];\n  /** Applied last, so a consent platform's `text/plain` beats a descriptor's own type. */\n  extraAttributes?: Record<string, string>;\n}): HTMLScriptElement[] {\n  const createdNodes: HTMLScriptElement[] = [];\n  descriptors.forEach((descriptor, index) => {\n    const nodeId = `${baseId}#${index}`;\n    if (document.querySelector(`script[data-replo-script-id=\"${nodeId}\"]`)) {\n      return;\n    }\n    const scriptElement = document.createElement(\"script\");\n    scriptElement.dataset.reploScriptId = nodeId;\n    if (descriptor.kind === \"external\") {\n      scriptElement.src = descriptor.src;\n      scriptElement.async = true;\n      for (const [attributeName, attributeValue] of Object.entries(\n        descriptor.attributes ?? {},\n      )) {\n        scriptElement.setAttribute(attributeName, attributeValue);\n      }\n    } else if (descriptor.module && extraAttributes?.type === \"text/plain\") {\n      // A consent platform restores blocked tags as CLASSIC scripts, which is a\n      // SyntaxError for module source. The blocked body is a classic shim that\n      // re-creates the real module tag when the platform activates it.\n      scriptElement.textContent = buildModuleShim(descriptor.body);\n    } else {\n      // Module snippets (top-level await, import()) are a SyntaxError as\n      // classic scripts, so the type must survive injection.\n      if (descriptor.module) {\n        scriptElement.type = \"module\";\n      }\n      scriptElement.textContent = descriptor.body;\n    }\n    for (const [attributeName, attributeValue] of Object.entries(\n      extraAttributes ?? {},\n    )) {\n      scriptElement.setAttribute(attributeName, attributeValue);\n    }\n    document.head.append(scriptElement);\n    createdNodes.push(scriptElement);\n  });\n  return createdNodes;\n}\n\nfunction buildModuleShim(body: string): string {\n  return [\n    'var moduleScript = document.createElement(\"script\");',\n    'moduleScript.type = \"module\";',\n    `moduleScript.textContent = ${JSON.stringify(body)};`,\n    \"document.head.append(moduleScript);\",\n  ].join(\"\\n\");\n}\n"],
+  "mappings": "AAQO,SAAS,wBAAwB;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AACF,GAKwB;AACtB,QAAM,eAAoC,CAAC;AAC3C,cAAY,QAAQ,CAAC,YAAY,UAAU;AACzC,UAAM,SAAS,GAAG,MAAM,IAAI,KAAK;AACjC,QAAI,SAAS,cAAc,gCAAgC,MAAM,IAAI,GAAG;AACtE;AAAA,IACF;AACA,UAAM,gBAAgB,SAAS,cAAc,QAAQ;AACrD,kBAAc,QAAQ,gBAAgB;AACtC,QAAI,WAAW,SAAS,YAAY;AAClC,oBAAc,MAAM,WAAW;AAC/B,oBAAc,QAAQ;AACtB,iBAAW,CAAC,eAAe,cAAc,KAAK,OAAO;AAAA,QACnD,WAAW,cAAc,CAAC;AAAA,MAC5B,GAAG;AACD,sBAAc,aAAa,eAAe,cAAc;AAAA,MAC1D;AAAA,IACF,WAAW,WAAW,UAAU,iBAAiB,SAAS,cAAc;AAItE,oBAAc,cAAc,gBAAgB,WAAW,IAAI;AAAA,IAC7D,OAAO;AAGL,UAAI,WAAW,QAAQ;AACrB,sBAAc,OAAO;AAAA,MACvB;AACA,oBAAc,cAAc,WAAW;AAAA,IACzC;AACA,eAAW,CAAC,eAAe,cAAc,KAAK,OAAO;AAAA,MACnD,mBAAmB,CAAC;AAAA,IACtB,GAAG;AACD,oBAAc,aAAa,eAAe,cAAc;AAAA,IAC1D;AACA,aAAS,KAAK,OAAO,aAAa;AAClC,iBAAa,KAAK,aAAa;AAAA,EACjC,CAAC;AACD,SAAO;AACT;AAEA,SAAS,gBAAgB,MAAsB;AAC7C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,8BAA8B,KAAK,UAAU,IAAI,CAAC;AAAA,IAClD;AAAA,EACF,EAAE,KAAK,IAAI;AACb;",
   "names": []
 }