@rovela-ai/sdk 0.17.0 → 0.18.0

package/dist/core/cookie-consent/CookieConsentProvider.d.ts

@@ -17,7 +17,7 @@
  *     and want scripts to run unconditionally.
  */
 import * as React from 'react';
-import type { ConsentCategories, ConsentRecord } from './types';
+import type { ConsentCategories, ConsentRecord, CookieConsentConfig } from './types';
 interface CookieConsentContextValue {
     /** The current consent record. `decidedAt === null` means the user
      *  has not yet chosen. */
@@ -40,14 +40,23 @@ interface CookieConsentContextValue {
     preferencesOpen: boolean;
     /** Banner uses this to close its own preferences layer after Save. */
     closePreferences: () => void;
+    /** Merchant banner configuration (layout / theme / copy / reopen). */
+    config: CookieConsentConfig;
 }
 export interface CookieConsentProviderProps {
     /** Master toggle from store_settings.cookie_banner_enabled. When
      *  `false`, the banner never renders and scripts get implicit grant. */
     enabled: boolean;
+    /** Merchant banner configuration (store_settings.cookie_consent,
+     *  sanitized server-side). Absent = every default = pre-config behavior. */
+    config?: CookieConsentConfig | null;
+    /** Region rule verdict, computed SERVER-side from the visitor's IP
+     *  country (config.region === 'eu-only' + non-EU visitor). Exempt
+     *  visitors get the same implicit-grant path as a disabled banner. */
+    regionExempt?: boolean;
     children: React.ReactNode;
 }
-export declare function CookieConsentProvider({ enabled, children, }: CookieConsentProviderProps): import("react/jsx-runtime").JSX.Element;
+export declare function CookieConsentProvider({ enabled, config, regionExempt, children, }: CookieConsentProviderProps): import("react/jsx-runtime").JSX.Element;
 export declare function useConsentContext(): CookieConsentContextValue;
 export {};
 //# sourceMappingURL=CookieConsentProvider.d.ts.map

package/dist/core/cookie-consent/CookieConsentProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CookieConsentProvider.d.ts","sourceRoot":"","sources":["../../../src/core/cookie-consent/CookieConsentProvider.tsx"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAC9B,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAsB/D,UAAU,yBAAyB;IACjC;8BAC0B;IAC1B,OAAO,EAAE,aAAa,CAAA;IACtB;;mEAE+D;IAC/D,UAAU,EAAE,OAAO,CAAA;IACnB;kEAC8D;IAC9D,cAAc,EAAE,OAAO,CAAA;IACvB;iCAC6B;IAC7B,MAAM,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC,iBAAiB,CAAC,KAAK,IAAI,CAAA;IACxD;qCACiC;IACjC,eAAe,EAAE,MAAM,IAAI,CAAA;IAC3B;yEACqE;IACrE,eAAe,EAAE,OAAO,CAAA;IACxB,sEAAsE;IACtE,gBAAgB,EAAE,MAAM,IAAI,CAAA;CAC7B;AA6ED,MAAM,WAAW,0BAA0B;IACzC;4EACwE;IACxE,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAC1B;AAED,wBAAgB,qBAAqB,CAAC,EACpC,OAAO,EACP,QAAQ,GACT,EAAE,0BAA0B,2CAgE5B;AAMD,wBAAgB,iBAAiB,IAAI,yBAAyB,CAQ7D"}
+{"version":3,"file":"CookieConsentProvider.d.ts","sourceRoot":"","sources":["../../../src/core/cookie-consent/CookieConsentProvider.tsx"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAC9B,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAA;AAsBpF,UAAU,yBAAyB;IACjC;8BAC0B;IAC1B,OAAO,EAAE,aAAa,CAAA;IACtB;;mEAE+D;IAC/D,UAAU,EAAE,OAAO,CAAA;IACnB;kEAC8D;IAC9D,cAAc,EAAE,OAAO,CAAA;IACvB;iCAC6B;IAC7B,MAAM,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC,iBAAiB,CAAC,KAAK,IAAI,CAAA;IACxD;qCACiC;IACjC,eAAe,EAAE,MAAM,IAAI,CAAA;IAC3B;yEACqE;IACrE,eAAe,EAAE,OAAO,CAAA;IACxB,sEAAsE;IACtE,gBAAgB,EAAE,MAAM,IAAI,CAAA;IAC5B,sEAAsE;IACtE,MAAM,EAAE,mBAAmB,CAAA;CAC5B;AA6ED,MAAM,WAAW,0BAA0B;IACzC;4EACwE;IACxE,OAAO,EAAE,OAAO,CAAA;IAChB;gFAC4E;IAC5E,MAAM,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAA;IACnC;;0EAEsE;IACtE,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;CAC1B;AAED,wBAAgB,qBAAqB,CAAC,EACpC,OAAO,EACP,MAAM,EACN,YAAoB,EACpB,QAAQ,GACT,EAAE,0BAA0B,2CAmF5B;AAMD,wBAAgB,iBAAiB,IAAI,yBAAyB,CAQ7D"}

package/dist/core/cookie-consent/CookieConsentProvider.js

@@ -97,7 +97,10 @@ function writeStoredConsent(record) {
         // for the session; user re-prompts next visit.
     }
 }
-export function CookieConsentProvider({ enabled, children, }) {
+export function CookieConsentProvider({ enabled, config, regionExempt = false, children, }) {
+    // Region-exempt visitors follow the exact disabled-banner path: implicit
+    // grant, no banner, no preferences affordances.
+    const effectiveEnabled = enabled && !regionExempt;
     // SSR-safe initial state — provider always starts with "not decided";
     // the post-mount effect reads localStorage and updates. Means we don't
     // hydration-mismatch between server and client.
@@ -106,9 +109,9 @@ export function CookieConsentProvider({ enabled, children, }) {
     const [preferencesOpen, setPreferencesOpen] = React.useState(false);
     // On mount, read the stored decision (if any within re-prompt window).
     React.useEffect(() => {
-        if (!enabled) {
-            // Admin disabled the banner — grant everything so analytics/
-            // marketing scripts can run. This is the merchant's call.
+        if (!effectiveEnabled) {
+            // Admin disabled the banner (or the visitor is outside the configured
+            // region) — grant everything so analytics/marketing scripts can run.
             setConsent(fullGrant());
             setHydrated(true);
             return;
@@ -117,7 +120,22 @@ export function CookieConsentProvider({ enabled, children, }) {
         if (stored)
             setConsent(stored);
         setHydrated(true);
-    }, [enabled]);
+    }, [effectiveEnabled]);
+    // Pixel bridge: expose the consent state to NON-React scripts (CC-installed
+    // pixel tags, Google Consent Mode wiring). `window.rovelaConsent` is the
+    // current state; 'rovela:consent-changed' fires on every change so tags can
+    // gate + update consent-mode signals without importing the hook.
+    React.useEffect(() => {
+        if (typeof window === 'undefined')
+            return;
+        const detail = {
+            analytics: consent.analytics,
+            marketing: consent.marketing,
+            decided: consent.decidedAt !== null,
+        };
+        window.rovelaConsent = detail;
+        window.dispatchEvent(new CustomEvent('rovela:consent-changed', { detail }));
+    }, [consent]);
     const update = React.useCallback((categories) => {
         const next = {
             essential: true,
@@ -138,12 +156,13 @@ export function CookieConsentProvider({ enabled, children, }) {
     const value = React.useMemo(() => ({
         consent,
         hasDecided: consent.decidedAt !== null,
-        bannerDisabled: !enabled,
+        bannerDisabled: !effectiveEnabled,
         update,
         openPreferences,
         preferencesOpen,
         closePreferences,
-    }), [consent, enabled, update, openPreferences, preferencesOpen, closePreferences]);
+        config: config ?? {},
+    }), [consent, effectiveEnabled, config, update, openPreferences, preferencesOpen, closePreferences]);
     // Don't flash children with stale SSR state → the first client render
     // is default (not-decided) which is safe: no scripts gate on it yet.
     void hydrated;

package/dist/core/cookie-consent/CookieConsentProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"CookieConsentProvider.js","sourceRoot":"","sources":["../../../src/core/cookie-consent/CookieConsentProvider.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAG9B,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,sDAAsD;AACtD,MAAM,WAAW,GAAG,uBAAuB,CAAA;AAE3C;;mCAEmC;AACnC,MAAM,OAAO,GAAG,CAAC,CAAA;AAEjB;oCACoC;AACpC,MAAM,mBAAmB,GAAG,GAAG,CAAA;AA8B/B,MAAM,oBAAoB,GACxB,KAAK,CAAC,aAAa,CAAmC,IAAI,CAAC,CAAA;AAE7D,gFAAgF;AAChF,WAAW;AACX,gFAAgF;AAEhF,SAAS,cAAc;IACrB,OAAO;QACL,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,OAAO;KACjB,CAAA;AACH,CAAC;AAED,SAAS,SAAS;IAChB,OAAO;QACL,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,OAAO;KACjB,CAAA;AACH,CAAC;AAED,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF,SAAS,iBAAiB;IACxB,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,IAAI,CAAA;IAC9C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QACpD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QACrB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAA;QAExD,wCAAwC;QACxC,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO;YAAE,OAAO,IAAI,CAAA;QAE3C,6CAA6C;QAC7C,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,OAAO,GACX,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;gBACnD,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;YACvB,IAAI,OAAO,GAAG,mBAAmB;gBAAE,OAAO,IAAI,CAAA;QAChD,CAAC;QAED,OAAO;YACL,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS;YAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS;YAC7B,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;YACnC,OAAO,EAAE,OAAO;SACjB,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAqB;IAC/C,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAM;IACzC,IAAI,CAAC;QACH,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,+CAA+C;IACjD,CAAC;AACH,CAAC;AAaD,MAAM,UAAU,qBAAqB,CAAC,EACpC,OAAO,EACP,QAAQ,GACmB;IAC3B,sEAAsE;IACtE,uEAAuE;IACvE,gDAAgD;IAChD,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAgB,cAAc,CAAC,CAAA;IAC3E,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACrD,MAAM,CAAC,eAAe,EAAE,kBAAkB,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAEnE,uEAAuE;IACvE,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE;QACnB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,6DAA6D;YAC7D,0DAA0D;YAC1D,UAAU,CAAC,SAAS,EAAE,CAAC,CAAA;YACvB,WAAW,CAAC,IAAI,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QACD,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAA;QAClC,IAAI,MAAM;YAAE,UAAU,CAAC,MAAM,CAAC,CAAA;QAC9B,WAAW,CAAC,IAAI,CAAC,CAAA;IACnB,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAEb,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,UAAsC,EAAE,EAAE;QAC1E,MAAM,IAAI,GAAkB;YAC1B,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,UAAU,CAAC,SAAS,IAAI,KAAK;YACxC,SAAS,EAAE,UAAU,CAAC,SAAS,IAAI,KAAK;YACxC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,OAAO;SACjB,CAAA;QACD,UAAU,CAAC,IAAI,CAAC,CAAA;QAChB,kBAAkB,CAAC,IAAI,CAAC,CAAA;IAC1B,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,MAAM,eAAe,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE;QAC7C,kBAAkB,CAAC,IAAI,CAAC,CAAA;IAC1B,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,MAAM,gBAAgB,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE;QAC9C,kBAAkB,CAAC,KAAK,CAAC,CAAA;IAC3B,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,MAAM,KAAK,GAA8B,KAAK,CAAC,OAAO,CACpD,GAAG,EAAE,CAAC,CAAC;QACL,OAAO;QACP,UAAU,EAAE,OAAO,CAAC,SAAS,KAAK,IAAI;QACtC,cAAc,EAAE,CAAC,OAAO;QACxB,MAAM;QACN,eAAe;QACf,eAAe;QACf,gBAAgB;KACjB,CAAC,EACF,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAC/E,CAAA;IAED,sEAAsE;IACtE,qEAAqE;IACrE,KAAK,QAAQ,CAAA;IAEb,OAAO,CACL,KAAC,oBAAoB,CAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,YACxC,QAAQ,GACqB,CACjC,CAAA;AACH,CAAC;AAED,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF,MAAM,UAAU,iBAAiB;IAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAA;IAClD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAA;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"CookieConsentProvider.js","sourceRoot":"","sources":["../../../src/core/cookie-consent/CookieConsentProvider.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAG9B,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,sDAAsD;AACtD,MAAM,WAAW,GAAG,uBAAuB,CAAA;AAE3C;;mCAEmC;AACnC,MAAM,OAAO,GAAG,CAAC,CAAA;AAEjB;oCACoC;AACpC,MAAM,mBAAmB,GAAG,GAAG,CAAA;AAgC/B,MAAM,oBAAoB,GACxB,KAAK,CAAC,aAAa,CAAmC,IAAI,CAAC,CAAA;AAE7D,gFAAgF;AAChF,WAAW;AACX,gFAAgF;AAEhF,SAAS,cAAc;IACrB,OAAO;QACL,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,OAAO;KACjB,CAAA;AACH,CAAC;AAED,SAAS,SAAS;IAChB,OAAO;QACL,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,OAAO;KACjB,CAAA;AACH,CAAC;AAED,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF,SAAS,iBAAiB;IACxB,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,IAAI,CAAA;IAC9C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QACpD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QACrB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAA;QAExD,wCAAwC;QACxC,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO;YAAE,OAAO,IAAI,CAAA;QAE3C,6CAA6C;QAC7C,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,OAAO,GACX,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;gBACnD,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;YACvB,IAAI,OAAO,GAAG,mBAAmB;gBAAE,OAAO,IAAI,CAAA;QAChD,CAAC;QAED,OAAO;YACL,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS;YAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS;YAC7B,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;YACnC,OAAO,EAAE,OAAO;SACjB,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAqB;IAC/C,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAM;IACzC,IAAI,CAAC;QACH,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,+CAA+C;IACjD,CAAC;AACH,CAAC;AAoBD,MAAM,UAAU,qBAAqB,CAAC,EACpC,OAAO,EACP,MAAM,EACN,YAAY,GAAG,KAAK,EACpB,QAAQ,GACmB;IAC3B,yEAAyE;IACzE,gDAAgD;IAChD,MAAM,gBAAgB,GAAG,OAAO,IAAI,CAAC,YAAY,CAAA;IACjD,sEAAsE;IACtE,uEAAuE;IACvE,gDAAgD;IAChD,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAgB,cAAc,CAAC,CAAA;IAC3E,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACrD,MAAM,CAAC,eAAe,EAAE,kBAAkB,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAEnE,uEAAuE;IACvE,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE;QACnB,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,sEAAsE;YACtE,qEAAqE;YACrE,UAAU,CAAC,SAAS,EAAE,CAAC,CAAA;YACvB,WAAW,CAAC,IAAI,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QACD,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAA;QAClC,IAAI,MAAM;YAAE,UAAU,CAAC,MAAM,CAAC,CAAA;QAC9B,WAAW,CAAC,IAAI,CAAC,CAAA;IACnB,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAA;IAEtB,4EAA4E;IAC5E,yEAAyE;IACzE,4EAA4E;IAC5E,iEAAiE;IACjE,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE;QACnB,IAAI,OAAO,MAAM,KAAK,WAAW;YAAE,OAAM;QACzC,MAAM,MAAM,GAAG;YACb,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,OAAO,CAAC,SAAS,KAAK,IAAI;SACpC,CACA;QAAC,MAAuD,CAAC,aAAa,GAAG,MAAM,CAAA;QAChF,MAAM,CAAC,aAAa,CAAC,IAAI,WAAW,CAAC,wBAAwB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;IAC7E,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAEb,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,UAAsC,EAAE,EAAE;QAC1E,MAAM,IAAI,GAAkB;YAC1B,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,UAAU,CAAC,SAAS,IAAI,KAAK;YACxC,SAAS,EAAE,UAAU,CAAC,SAAS,IAAI,KAAK;YACxC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,OAAO;SACjB,CAAA;QACD,UAAU,CAAC,IAAI,CAAC,CAAA;QAChB,kBAAkB,CAAC,IAAI,CAAC,CAAA;IAC1B,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,MAAM,eAAe,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE;QAC7C,kBAAkB,CAAC,IAAI,CAAC,CAAA;IAC1B,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,MAAM,gBAAgB,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE;QAC9C,kBAAkB,CAAC,KAAK,CAAC,CAAA;IAC3B,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,MAAM,KAAK,GAA8B,KAAK,CAAC,OAAO,CACpD,GAAG,EAAE,CAAC,CAAC;QACL,OAAO;QACP,UAAU,EAAE,OAAO,CAAC,SAAS,KAAK,IAAI;QACtC,cAAc,EAAE,CAAC,gBAAgB;QACjC,MAAM;QACN,eAAe;QACf,eAAe;QACf,gBAAgB;QAChB,MAAM,EAAE,MAAM,IAAI,EAAE;KACrB,CAAC,EACF,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAChG,CAAA;IAED,sEAAsE;IACtE,qEAAqE;IACrE,KAAK,QAAQ,CAAA;IAEb,OAAO,CACL,KAAC,oBAAoB,CAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,YACxC,QAAQ,GACqB,CACjC,CAAA;AACH,CAAC;AAED,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF,MAAM,UAAU,iBAAiB;IAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAA;IAClD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAA;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/core/cookie-consent/CookiePreferencesLink.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CookiePreferencesLink.d.ts","sourceRoot":"","sources":["../../../src/core/cookie-consent/CookiePreferencesLink.tsx"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAI9B,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAC3C,KAAK,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,EAC7C,SAAS,GAAG,MAAM,CACnB,CAAA;AAED,wBAAgB,qBAAqB,CAAC,EACpC,QAAQ,EACR,GAAG,KAAK,EACT,EAAE,0BAA0B,kDAa5B"}
+{"version":3,"file":"CookiePreferencesLink.d.ts","sourceRoot":"","sources":["../../../src/core/cookie-consent/CookiePreferencesLink.tsx"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAI9B,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAC3C,KAAK,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,EAC7C,SAAS,GAAG,MAAM,CACnB,CAAA;AAED,wBAAgB,qBAAqB,CAAC,EACpC,QAAQ,EACR,GAAG,KAAK,EACT,EAAE,0BAA0B,kDAe5B"}

package/dist/core/cookie-consent/CookiePreferencesLink.js

@@ -4,10 +4,12 @@ import { useConsentContext } from './CookieConsentProvider';
 import { useT } from '../i18n';
 export function CookiePreferencesLink({ children, ...props }) {
     const t = useT();
-    const { openPreferences, bannerDisabled } = useConsentContext();
+    const { openPreferences, bannerDisabled, config } = useConsentContext();
     // If the merchant has disabled the banner entirely, there are no
-    // preferences to manage — don't render the link at all.
-    if (bannerDisabled)
+    // preferences to manage — don't render the link at all. Same when the
+    // reopen affordance is configured as badge-ONLY (the floating badge is
+    // the sole reopen surface then).
+    if (bannerDisabled || config.reopen === 'badge')
         return null;
     return (_jsx("button", { type: "button", onClick: openPreferences, ...props, children: children ?? t('consent.title') }));
 }

package/dist/core/cookie-consent/CookiePreferencesLink.js.map

@@ -1 +1 @@
-{"version":3,"file":"CookiePreferencesLink.js","sourceRoot":"","sources":["../../../src/core/cookie-consent/CookiePreferencesLink.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAeZ,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAA;AAO9B,MAAM,UAAU,qBAAqB,CAAC,EACpC,QAAQ,EACR,GAAG,KAAK,EACmB;IAC3B,MAAM,CAAC,GAAG,IAAI,EAAE,CAAA;IAChB,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,iBAAiB,EAAE,CAAA;IAE/D,iEAAiE;IACjE,wDAAwD;IACxD,IAAI,cAAc;QAAE,OAAO,IAAI,CAAA;IAE/B,OAAO,CACL,iBAAQ,IAAI,EAAC,QAAQ,EAAC,OAAO,EAAE,eAAe,KAAM,KAAK,YACtD,QAAQ,IAAI,CAAC,CAAC,eAAe,CAAC,GACxB,CACV,CAAA;AACH,CAAC"}
+{"version":3,"file":"CookiePreferencesLink.js","sourceRoot":"","sources":["../../../src/core/cookie-consent/CookiePreferencesLink.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAeZ,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAA;AAO9B,MAAM,UAAU,qBAAqB,CAAC,EACpC,QAAQ,EACR,GAAG,KAAK,EACmB;IAC3B,MAAM,CAAC,GAAG,IAAI,EAAE,CAAA;IAChB,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAA;IAEvE,iEAAiE;IACjE,sEAAsE;IACtE,uEAAuE;IACvE,iCAAiC;IACjC,IAAI,cAAc,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IAE5D,OAAO,CACL,iBAAQ,IAAI,EAAC,QAAQ,EAAC,OAAO,EAAE,eAAe,KAAM,KAAK,YACtD,QAAQ,IAAI,CAAC,CAAC,eAAe,CAAC,GACxB,CACV,CAAA;AACH,CAAC"}

package/dist/core/cookie-consent/index.d.ts

@@ -13,5 +13,6 @@ export { CookieConsentProvider, type CookieConsentProviderProps, } from './Cooki
 export { CookieBanner } from './CookieBanner';
 export { CookiePreferencesLink, type CookiePreferencesLinkProps, } from './CookiePreferencesLink';
 export { useCookieConsent, type UseCookieConsentReturn } from './useCookieConsent';
-export type { ConsentCategories, ConsentRecord, CategoryKey } from './types';
+export type { ConsentCategories, ConsentRecord, CategoryKey, CookieConsentConfig, ConsentBannerLayout, ConsentBannerPosition, ConsentBannerTheme, ConsentBannerColors, ConsentCopyOverrides, ConsentRegionRule, ConsentReopenAffordance, } from './types';
+export { CONSENT_EU_REGION, consentRegionExempt, sanitizeCookieConsentConfig, } from './types';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/cookie-consent/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/cookie-consent/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,qBAAqB,EACrB,KAAK,0BAA0B,GAChC,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,EACL,qBAAqB,EACrB,KAAK,0BAA0B,GAChC,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAClF,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/cookie-consent/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,qBAAqB,EACrB,KAAK,0BAA0B,GAChC,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,EACL,qBAAqB,EACrB,KAAK,0BAA0B,GAChC,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAClF,YAAY,EACV,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,SAAS,CAAA;AAChB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,2BAA2B,GAC5B,MAAM,SAAS,CAAA"}

package/dist/core/cookie-consent/index.js

@@ -13,4 +13,5 @@ export { CookieConsentProvider, } from './CookieConsentProvider';
 export { CookieBanner } from './CookieBanner';
 export { CookiePreferencesLink, } from './CookiePreferencesLink';
 export { useCookieConsent } from './useCookieConsent';
+export { CONSENT_EU_REGION, consentRegionExempt, sanitizeCookieConsentConfig, } from './types';
 //# sourceMappingURL=index.js.map

package/dist/core/cookie-consent/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/cookie-consent/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,qBAAqB,GAEtB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,EACL,qBAAqB,GAEtB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,gBAAgB,EAA+B,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/cookie-consent/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,qBAAqB,GAEtB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,EACL,qBAAqB,GAEtB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,gBAAgB,EAA+B,MAAM,oBAAoB,CAAA;AAclF,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,2BAA2B,GAC5B,MAAM,SAAS,CAAA"}

package/dist/core/cookie-consent/types.d.ts

@@ -1,10 +1,16 @@
 /**
- * Cookie consent types (R021).
+ * Cookie consent types + banner configuration (R021).
  *
- * Shared shape between provider, banner, hook. Keep lean — the minimum
- * viable EDPB-compliant categorization is Essential / Analytics /
- * Marketing. We do NOT ship per-vendor granularity; categories are the
+ * Consent state stays lean — the minimum viable EDPB-compliant
+ * categorization is Essential / Analytics / Marketing; categories are the
  * contract any storefront script follows via `useCookieConsent()`.
+ *
+ * COMPLIANCE GUARDRAILS ARE NOT CONFIGURABLE — reject parity, no pre-ticked
+ * boxes, close-equals-refusal, the three-category model and the 12-month
+ * re-consent window are hard-coded in the banner. The config below only
+ * shapes presentation (layout, colors, copy), audience (region rule) and
+ * the reopen affordance. That is the guarantee: when the merchant enables
+ * the banner, the compliant behavior cannot be configured away.
  */
 export interface ConsentCategories {
     /** Strictly necessary (cart, session, login). Always on, never
@@ -28,4 +34,64 @@ export interface ConsentRecord extends ConsentCategories {
     version: number;
 }
 export type CategoryKey = 'analytics' | 'marketing';
+export type ConsentBannerLayout = 'card' | 'bar' | 'modal';
+export type ConsentBannerPosition = 'bottom-left' | 'bottom-right' | 'bottom-center';
+export type ConsentBannerTheme = 'auto' | 'light' | 'dark' | 'custom';
+export type ConsentRegionRule = 'worldwide' | 'eu-only';
+export type ConsentReopenAffordance = 'link' | 'badge' | 'both';
+export interface ConsentBannerColors {
+    /** Card/bar background. */
+    background?: string;
+    /** Body text color. */
+    text?: string;
+    /** Accept-all button background. */
+    accent?: string;
+    /** Accept-all button text. */
+    accentText?: string;
+}
+/** Per-locale copy overrides. Missing keys fall back to the i18n catalog. */
+export interface ConsentCopyOverrides {
+    title?: string;
+    intro?: string;
+    acceptAll?: string;
+    rejectAll?: string;
+    customize?: string;
+}
+export interface CookieConsentConfig {
+    /** Banner shell: floating card (default) / full-width bar / centered modal. */
+    layout?: ConsentBannerLayout;
+    /** Corner for the card layout (bar is always bottom, modal always center). */
+    position?: ConsentBannerPosition;
+    /** 'auto' (default) derives from the store's CSS tokens; light/dark fix
+     *  the neutrals; 'custom' uses `colors`. */
+    theme?: ConsentBannerTheme;
+    colors?: ConsentBannerColors;
+    /** Per-locale copy overrides keyed by locale code ('en', 'fr', ...). */
+    copy?: Record<string, ConsentCopyOverrides>;
+    /** Who sees the banner. 'eu-only' shows it to EU/EEA/UK/CH visitors and
+     *  grants-by-default elsewhere; 'worldwide' (default) shows it to everyone. */
+    region?: ConsentRegionRule;
+    /** How users re-open preferences after deciding: footer link (default),
+     *  a floating badge, or both. */
+    reopen?: ConsentReopenAffordance;
+}
+/**
+ * ISO-3166-1 alpha-2 countries where GDPR/ePrivacy-style prior consent
+ * applies: all 27 EU members + EEA (IS, LI, NO) + UK + Switzerland.
+ * (Deliberately broader than the seed's banner-default heuristic — this set
+ * gates a compliance RULE, not a default.)
+ */
+export declare const CONSENT_EU_REGION: Set<string>;
+/**
+ * Whether a visitor is exempt from the banner under the config's region
+ * rule. Unknown country (no geo header — sandbox, self-hosted, bots) is
+ * NEVER exempt: fail closed toward showing the banner.
+ */
+export declare function consentRegionExempt(config: CookieConsentConfig | null | undefined, country: string | null | undefined): boolean;
+/**
+ * Validate + strip unknown keys from a raw config object (admin PUT body or
+ * a store_settings row). Never throws; anything unrecognized is dropped so
+ * a hand-edited row can degrade but never break the storefront.
+ */
+export declare function sanitizeCookieConsentConfig(raw: unknown): CookieConsentConfig;
 //# sourceMappingURL=types.d.ts.map

package/dist/core/cookie-consent/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/cookie-consent/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,WAAW,iBAAiB;IAChC;;8DAE0D;IAC1D,SAAS,EAAE,IAAI,CAAA;IACf;4BACwB;IACxB,SAAS,EAAE,OAAO,CAAA;IAClB;sDACkD;IAClD,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,MAAM,WAAW,aAAc,SAAQ,iBAAiB;IACtD;+CAC2C;IAC3C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB;;4EAEwE;IACxE,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,WAAW,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/cookie-consent/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,MAAM,WAAW,iBAAiB;IAChC;;8DAE0D;IAC1D,SAAS,EAAE,IAAI,CAAA;IACf;4BACwB;IACxB,SAAS,EAAE,OAAO,CAAA;IAClB;sDACkD;IAClD,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,MAAM,WAAW,aAAc,SAAQ,iBAAiB;IACtD;+CAC2C;IAC3C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB;;4EAEwE;IACxE,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,WAAW,CAAA;AAMnD,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,CAAA;AAC1D,MAAM,MAAM,qBAAqB,GAAG,aAAa,GAAG,cAAc,GAAG,eAAe,CAAA;AACpF,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAA;AACrE,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,SAAS,CAAA;AACvD,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAA;AAE/D,MAAM,WAAW,mBAAmB;IAClC,2BAA2B;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,uBAAuB;IACvB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,oCAAoC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,8BAA8B;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,6EAA6E;AAC7E,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,+EAA+E;IAC/E,MAAM,CAAC,EAAE,mBAAmB,CAAA;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,qBAAqB,CAAA;IAChC;gDAC4C;IAC5C,KAAK,CAAC,EAAE,kBAAkB,CAAA;IAC1B,MAAM,CAAC,EAAE,mBAAmB,CAAA;IAC5B,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAC3C;mFAC+E;IAC/E,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B;qCACiC;IACjC,MAAM,CAAC,EAAE,uBAAuB,CAAA;CACjC;AAMD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,aAM5B,CAAA;AAEF;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,mBAAmB,GAAG,IAAI,GAAG,SAAS,EAC9C,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACjC,OAAO,CAIT;AAwBD;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,OAAO,GAAG,mBAAmB,CA6C7E"}

package/dist/core/cookie-consent/types.js

@@ -1,10 +1,122 @@
 /**
- * Cookie consent types (R021).
+ * Cookie consent types + banner configuration (R021).
  *
- * Shared shape between provider, banner, hook. Keep lean — the minimum
- * viable EDPB-compliant categorization is Essential / Analytics /
- * Marketing. We do NOT ship per-vendor granularity; categories are the
+ * Consent state stays lean — the minimum viable EDPB-compliant
+ * categorization is Essential / Analytics / Marketing; categories are the
  * contract any storefront script follows via `useCookieConsent()`.
+ *
+ * COMPLIANCE GUARDRAILS ARE NOT CONFIGURABLE — reject parity, no pre-ticked
+ * boxes, close-equals-refusal, the three-category model and the 12-month
+ * re-consent window are hard-coded in the banner. The config below only
+ * shapes presentation (layout, colors, copy), audience (region rule) and
+ * the reopen affordance. That is the guarantee: when the merchant enables
+ * the banner, the compliant behavior cannot be configured away.
+ */
+// =============================================================================
+// Region rule — the compliance-correct EU/EEA + UK + CH set
+// =============================================================================
+/**
+ * ISO-3166-1 alpha-2 countries where GDPR/ePrivacy-style prior consent
+ * applies: all 27 EU members + EEA (IS, LI, NO) + UK + Switzerland.
+ * (Deliberately broader than the seed's banner-default heuristic — this set
+ * gates a compliance RULE, not a default.)
+ */
+export const CONSENT_EU_REGION = new Set([
+    'AT', 'BE', 'BG', 'HR', 'CY', 'CZ', 'DK', 'EE', 'FI', 'FR',
+    'DE', 'GR', 'HU', 'IE', 'IT', 'LV', 'LT', 'LU', 'MT', 'NL',
+    'PL', 'PT', 'RO', 'SK', 'SI', 'ES', 'SE',
+    'IS', 'LI', 'NO',
+    'GB', 'CH',
+]);
+/**
+ * Whether a visitor is exempt from the banner under the config's region
+ * rule. Unknown country (no geo header — sandbox, self-hosted, bots) is
+ * NEVER exempt: fail closed toward showing the banner.
+ */
+export function consentRegionExempt(config, country) {
+    if (config?.region !== 'eu-only')
+        return false;
+    if (!country)
+        return false;
+    return !CONSENT_EU_REGION.has(country.toUpperCase());
+}
+// =============================================================================
+// Config sanitizer — the ONLY ingress for merchant-supplied config JSON
+// =============================================================================
+const LAYOUTS = ['card', 'bar', 'modal'];
+const POSITIONS = ['bottom-left', 'bottom-right', 'bottom-center'];
+const THEMES = ['auto', 'light', 'dark', 'custom'];
+const REGIONS = ['worldwide', 'eu-only'];
+const REOPENS = ['link', 'badge', 'both'];
+const COPY_KEYS = [
+    'title', 'intro', 'acceptAll', 'rejectAll', 'customize',
+];
+const HEX_RE = /^#[0-9a-fA-F]{3,8}$/;
+const MAX_COPY = 500;
+const MAX_LOCALES = 12;
+function pickEnum(value, allowed) {
+    return typeof value === 'string' && allowed.includes(value)
+        ? value
+        : undefined;
+}
+/**
+ * Validate + strip unknown keys from a raw config object (admin PUT body or
+ * a store_settings row). Never throws; anything unrecognized is dropped so
+ * a hand-edited row can degrade but never break the storefront.
  */
-export {};
+export function sanitizeCookieConsentConfig(raw) {
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        return {};
+    const r = raw;
+    const out = {};
+    const layout = pickEnum(r.layout, LAYOUTS);
+    if (layout)
+        out.layout = layout;
+    const position = pickEnum(r.position, POSITIONS);
+    if (position)
+        out.position = position;
+    const theme = pickEnum(r.theme, THEMES);
+    if (theme)
+        out.theme = theme;
+    const region = pickEnum(r.region, REGIONS);
+    if (region)
+        out.region = region;
+    const reopen = pickEnum(r.reopen, REOPENS);
+    if (reopen)
+        out.reopen = reopen;
+    if (r.colors && typeof r.colors === 'object' && !Array.isArray(r.colors)) {
+        const c = r.colors;
+        const colors = {};
+        for (const key of ['background', 'text', 'accent', 'accentText']) {
+            const v = c[key];
+            if (typeof v === 'string' && HEX_RE.test(v))
+                colors[key] = v;
+        }
+        if (Object.keys(colors).length > 0)
+            out.colors = colors;
+    }
+    if (r.copy && typeof r.copy === 'object' && !Array.isArray(r.copy)) {
+        const copy = {};
+        for (const [locale, entry] of Object.entries(r.copy)) {
+            if (Object.keys(copy).length >= MAX_LOCALES)
+                break;
+            if (!/^[a-z]{2}(-[A-Z]{2})?$/.test(locale))
+                continue;
+            if (!entry || typeof entry !== 'object' || Array.isArray(entry))
+                continue;
+            const clean = {};
+            for (const key of COPY_KEYS) {
+                const v = entry[key];
+                if (typeof v === 'string' && v.trim() !== '') {
+                    clean[key] = v.slice(0, MAX_COPY);
+                }
+            }
+            if (Object.keys(clean).length > 0)
+                copy[locale] = clean;
+        }
+        if (Object.keys(copy).length > 0)
+            out.copy = copy;
+    }
+    return out;
+}
 //# sourceMappingURL=types.js.map

package/dist/core/cookie-consent/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/core/cookie-consent/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/core/cookie-consent/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAgFH,gFAAgF;AAChF,4DAA4D;AAC5D,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IACvC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC1D,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC1D,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IACxC,IAAI,EAAE,IAAI,EAAE,IAAI;IAChB,IAAI,EAAE,IAAI;CACX,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAA8C,EAC9C,OAAkC;IAElC,IAAI,MAAM,EAAE,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IAC9C,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IAC1B,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;AACtD,CAAC;AAED,gFAAgF;AAChF,wEAAwE;AACxE,gFAAgF;AAEhF,MAAM,OAAO,GAA0B,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;AAC/D,MAAM,SAAS,GAA4B,CAAC,aAAa,EAAE,cAAc,EAAE,eAAe,CAAC,CAAA;AAC3F,MAAM,MAAM,GAAyB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;AACxE,MAAM,OAAO,GAAwB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;AAC7D,MAAM,OAAO,GAA8B,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;AACpE,MAAM,SAAS,GAAmC;IAChD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW;CACxD,CAAA;AACD,MAAM,MAAM,GAAG,qBAAqB,CAAA;AACpC,MAAM,QAAQ,GAAG,GAAG,CAAA;AACpB,MAAM,WAAW,GAAG,EAAE,CAAA;AAEtB,SAAS,QAAQ,CAAmB,KAAc,EAAE,OAAY;IAC9D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,OAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC;QACvE,CAAC,CAAE,KAAW;QACd,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,GAAY;IACtD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAA;IACpE,MAAM,CAAC,GAAG,GAA8B,CAAA;IACxC,MAAM,GAAG,GAAwB,EAAE,CAAA;IAEnC,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC1C,IAAI,MAAM;QAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAA;IAC/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IAChD,IAAI,QAAQ;QAAE,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAA;IACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACvC,IAAI,KAAK;QAAE,GAAG,CAAC,KAAK,GAAG,KAAK,CAAA;IAC5B,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC1C,IAAI,MAAM;QAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAA;IAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC1C,IAAI,MAAM;QAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAA;IAE/B,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QACzE,MAAM,CAAC,GAAG,CAAC,CAAC,MAAiC,CAAA;QAC7C,MAAM,MAAM,GAAwB,EAAE,CAAA;QACtC,KAAK,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAU,EAAE,CAAC;YAC1E,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAA;YAChB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC9D,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAA;IACzD,CAAC;IAED,IAAI,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,GAAyC,EAAE,CAAA;QACrD,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAA+B,CAAC,EAAE,CAAC;YAChF,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,WAAW;gBAAE,MAAK;YAClD,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,SAAQ;YACpD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,SAAQ;YACzE,MAAM,KAAK,GAAyB,EAAE,CAAA;YACtC,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC5B,MAAM,CAAC,GAAI,KAAiC,CAAC,GAAG,CAAC,CAAA;gBACjD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;oBAC7C,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;gBACnC,CAAC;YACH,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,CAAA;QACzD,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAA;IACnD,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/core/dates.d.ts

@@ -0,0 +1,15 @@
+/**
+ * @rovela/sdk/core/dates
+ *
+ * Timezone-safe date rendering helpers shared across modules (admin +
+ * analytics views). Pure functions — no React, safe on server and client.
+ */
+/**
+ * Format a server-produced plain day key ('YYYY-MM-DD') for display WITHOUT
+ * timezone shifting. `new Date('2026-07-10')` parses as UTC midnight, so
+ * `toLocaleDateString` in a negative-offset browser zone renders Jul 9 —
+ * off by one. Server day buckets are already computed in the store's
+ * timezone; this renders the key verbatim as a calendar date.
+ */
+export declare function formatDayLabel(dayKey: string, locale?: string, options?: Intl.DateTimeFormatOptions): string;
+//# sourceMappingURL=dates.d.ts.map

package/dist/core/dates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dates.d.ts","sourceRoot":"","sources":["../../src/core/dates.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,MAAM,GAAE,MAAgB,EACxB,OAAO,GAAE,IAAI,CAAC,qBAA0D,GACvE,MAAM,CAMR"}

package/dist/core/dates.js

@@ -0,0 +1,22 @@
+/**
+ * @rovela/sdk/core/dates
+ *
+ * Timezone-safe date rendering helpers shared across modules (admin +
+ * analytics views). Pure functions — no React, safe on server and client.
+ */
+/**
+ * Format a server-produced plain day key ('YYYY-MM-DD') for display WITHOUT
+ * timezone shifting. `new Date('2026-07-10')` parses as UTC midnight, so
+ * `toLocaleDateString` in a negative-offset browser zone renders Jul 9 —
+ * off by one. Server day buckets are already computed in the store's
+ * timezone; this renders the key verbatim as a calendar date.
+ */
+export function formatDayLabel(dayKey, locale = 'en-US', options = { month: 'short', day: 'numeric' }) {
+    const m = /^(\d{4})-(\d{2})-(\d{2})/.exec(dayKey);
+    if (!m)
+        return dayKey;
+    // Construct at UTC noon + format in UTC — immune to any zone shift.
+    const d = new Date(Date.UTC(Number(m[1]), Number(m[2]) - 1, Number(m[3]), 12));
+    return d.toLocaleDateString(locale, { ...options, timeZone: 'UTC' });
+}
+//# sourceMappingURL=dates.js.map

package/dist/core/dates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dates.js","sourceRoot":"","sources":["../../src/core/dates.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAc,EACd,SAAiB,OAAO,EACxB,UAAsC,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE;IAExE,MAAM,CAAC,GAAG,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACjD,IAAI,CAAC,CAAC;QAAE,OAAO,MAAM,CAAA;IACrB,oEAAoE;IACpE,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;IAC9E,OAAO,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;AACtE,CAAC"}

package/dist/core/db/queries.d.ts

@@ -538,12 +538,12 @@ export declare const GUEST_PASSWORD_HASH = "";
  * for the duplicate case, so it is safe to call inline in the checkout webhook.
  */
 export declare function findOrCreateGuestCustomer(email: string, name?: string | null): Promise<{
-    locale: string | null;
     id: string;
     name: string | null;
     createdAt: Date;
     updatedAt: Date;
     email: string;
+    locale: string | null;
     phone: string | null;
     passwordHash: string;
     stripeCustomerId: string | null;
@@ -803,8 +803,6 @@ export declare function getRecentOrders(limit?: number, periodDays?: number): Pr
  * Create a new order
  */
 export declare function createOrder(data: schema.NewOrder): Promise<{
-    currency: string | null;
-    locale: string | null;
     id: string;
     status: "pending" | "paid" | "shipped" | "delivered" | "cancelled" | "refunded" | "return_requested";
     createdAt: Date;
@@ -815,6 +813,8 @@ export declare function createOrder(data: schema.NewOrder): Promise<{
     tax: string;
     shipping: string;
     total: string;
+    currency: string | null;
+    locale: string | null;
     refundAmount: string | null;
     returnReason: string | null;
     discountCode: string | null;
@@ -1659,7 +1659,6 @@ export interface DiscountInput {
     sortOrder?: number;
 }
 export declare function createDiscount(data: DiscountInput): Promise<{
-    value: string;
     id: string;
     createdAt: Date;
     updatedAt: Date;
@@ -1669,6 +1668,7 @@ export declare function createDiscount(data: DiscountInput): Promise<{
     method: string;
     title: string;
     type: string;
+    value: string;
     appliesTo: string;
     targetIds: string[];
     minSubtotal: string | null;
@@ -1917,7 +1917,7 @@ export declare function countOrders(options?: {
  *
  * Date format is `YYYY-MM-DD` in UTC (matches Postgres `DATE()` output).
  */
-export declare function getRevenueByPeriod(days: number): Promise<{
+export declare function getRevenueByPeriod(days: number, timeZone?: string): Promise<{
     date: string;
     revenue: number;
 }[]>;
@@ -1951,6 +1951,8 @@ export interface StoreSettingsData {
     enabledLocales: string[] | null;
     /** Email theme (Phase D). NULL = derive from the store's brand. */
     emailTheme: Record<string, unknown> | null;
+    /** Cookie-banner configuration (SDK 0.18.0). NULL/{} = defaults. */
+    cookieConsent: Record<string, unknown> | null;
     taxIncludedInPrices: boolean | null;
     shippingEnabled: boolean | null;
     freeShippingThreshold: number | null;