@unitninety/site-kit 1.6.4 → 1.6.6

package/src/features/consent/registry.ts

@@ -1,398 +0,0 @@
-import {
-  classifyManagedIntegration,
-  ConsentInstallationSchema,
-  ConsentStateSchema,
-  deniedConsentState,
-  type ConsentAdapter,
-  type ConsentInstallation,
-  type ConsentState,
-} from '../contracts/consent'
-import { cookieScriptAdapter } from './cookieScript'
-import { customConsentAdapter, type CustomConsentRegistration } from './custom'
-import { createBrowserConsentDriver, CONSENT_LOAD_TIMEOUT_MS } from './drivers'
-import {
-  consentLoaderStatus,
-  createConsentLoader,
-  observeConsentLoader,
-  requireConsentReload,
-} from './loader'
-
-type Snapshot = {
-  state: ConsentState
-  ready: boolean
-  error: string | null
-  reloadRequired: boolean
-}
-type Identity = {
-  endpoint: string
-  provider: string
-  source: string
-  adapter?: ConsentAdapter
-  owner?: CustomConsentRegistration
-  reopen?: () => void
-}
-const registries = new WeakMap<Document, ReturnType<typeof createRegistry>>()
-export function consentRegistry(window: Window) {
-  let registry = registries.get(window.document)
-  if (!registry) {
-    registry = createRegistry(window)
-    registries.set(window.document, registry)
-  }
-  return registry
-}
-function identity(
-  endpoint: string,
-  installation: ConsentInstallation,
-  registration?: CustomConsentRegistration,
-): Identity {
-  return {
-    endpoint,
-    provider: installation.provider,
-    source: installation.scriptURL ?? '',
-    ...(installation.provider === 'custom'
-      ? registration?.adapter
-        ? { adapter: registration.adapter }
-        : { owner: registration, reopen: registration?.openPreferences }
-      : {}),
-  }
-}
-function same(a: Identity, b: Identity) {
-  return (
-    a.endpoint === b.endpoint &&
-    a.provider === b.provider &&
-    a.source === b.source &&
-    a.adapter === b.adapter &&
-    a.owner === b.owner &&
-    a.reopen === b.reopen
-  )
-}
-function validRegistration(registration?: CustomConsentRegistration) {
-  if (!registration) return false
-  if (registration.adapter !== undefined)
-    return (
-      registration.openPreferences === undefined &&
-      !!registration.adapter &&
-      ['read', 'subscribe', 'openPreferences'].every(
-        (key) => typeof registration.adapter?.[key as keyof ConsentAdapter] === 'function',
-      )
-    )
-  return typeof registration.openPreferences === 'function'
-}
-function createRegistry(window: Window) {
-  const driver = createBrowserConsentDriver(window)
-  const loader = createConsentLoader(driver)
-  const listeners = new Set<() => void>()
-  const owners = new Set<object>()
-  let endpoint: string | undefined
-  let enabled = false
-  let installation: ConsentInstallation | undefined
-  let registration: CustomConsentRegistration | undefined
-  let installed: Identity | undefined
-  let adapter: ConsentAdapter | undefined
-  let unsubscribe: (() => void) | undefined
-  let generation = 0
-  let activated = false
-  let attempted = false
-  let script: HTMLScriptElement | undefined
-  let providerFailed = false
-  let providerError: string | null = null
-  let timer: number | undefined
-  let loadTimer: number | undefined
-  let raw = deniedConsentState()
-  let snapshot: Snapshot = { state: raw, ready: false, error: null, reloadRequired: false }
-  const clearTimer = () => {
-    if (timer !== undefined) window.clearTimeout(timer)
-    timer = undefined
-  }
-  // Embedding a banner does not make it a consent authority for U90-managed scripts.
-  const embedOnly = () => installation?.provider === 'custom' && registration === undefined
-  const registrationComplete = () =>
-    installation?.provider !== 'custom' || validRegistration(registration)
-  const effective = () =>
-    enabled && owners.size === 1 && !!unsubscribe && !providerFailed && registrationComplete()
-      ? raw
-      : deniedConsentState()
-  const publish = () => {
-    const state = effective()
-    const status = consentLoaderStatus(driver)
-    const next = {
-      state: { ...state },
-      ready: state.ready,
-      error: status.reloadRequired
-        ? status.error
-        : !registrationComplete() && !embedOnly() && enabled
-          ? 'Custom consent registration is incomplete. Supply one adapter or a preferences callback.'
-          : (providerError ?? status.error),
-      reloadRequired: status.reloadRequired,
-    }
-    if (JSON.stringify(next) !== JSON.stringify(snapshot)) {
-      snapshot = next
-      for (const listener of listeners) listener()
-    }
-  }
-  observeConsentLoader(driver, () => {
-    if (consentLoaderStatus(driver).reloadRequired)
-      driver.setPermission(deniedConsentState(), installation?.googleMode ?? 'basic')
-    publish()
-  })
-  const reconcile = () => {
-    const state = effective()
-    const mode = installation?.googleMode ?? 'basic'
-    const blocked = consentLoaderStatus(driver).reloadRequired
-    driver.configure(installation?.integrations ?? [])
-    driver.setPermission(blocked ? deniedConsentState() : state, mode)
-    // Advanced mode is a request exception only for classified Google code. Generic rows stay category-gated.
-    const advanced = !blocked && state.ready && mode === 'advanced'
-    const integrations = installation?.integrations ?? []
-    const selected = advanced
-      ? integrations.filter(
-          (row) => state[row.category] || classifyManagedIntegration(row).kind === 'ga4',
-        )
-      : integrations
-    void loader.apply(advanced ? { ...state, analytics: true } : state, selected).catch(() => {
-      publish()
-    })
-    publish()
-  }
-  const receive = (value: unknown) => {
-    const parsed = ConsentStateSchema.safeParse(value)
-    raw = parsed.success ? parsed.data : deniedConsentState()
-    providerError = raw.ready ? null : 'Consent preferences are unavailable. Retry consent setup.'
-    if (raw.ready) clearTimer()
-    reconcile()
-  }
-  const readAdapter = () => {
-    if (!adapter) {
-      reconcile()
-      return
-    }
-    try {
-      receive(adapter?.read())
-    } catch {
-      receive(undefined)
-    }
-  }
-  const disconnect = () => {
-    ++generation
-    try {
-      unsubscribe?.()
-    } catch {
-      /* authority is already invalid */
-    }
-    unsubscribe = undefined
-    clearTimer()
-    raw = deniedConsentState()
-  }
-  const subscribe = () => {
-    if (!adapter || unsubscribe) return
-    const current = ++generation
-    try {
-      unsubscribe = adapter.subscribe((value) => {
-        if (current === generation && owners.size === 1 && !providerFailed) receive(value)
-      })
-      if (typeof unsubscribe !== 'function') throw Error('Subscription unavailable')
-      activated = true
-      readAdapter()
-    } catch {
-      providerFailed = true
-      providerError = 'Consent subscription unavailable. Retry consent setup.'
-      reconcile()
-    }
-  }
-  const watchReadiness = () => {
-    clearTimer()
-    if (!raw.ready)
-      timer = window.setTimeout(() => {
-        raw = deniedConsentState()
-        providerError = 'Consent provider did not become ready. Retry consent setup.'
-        reconcile()
-      }, CONSENT_LOAD_TIMEOUT_MS)
-  }
-  const install = () => {
-    if (
-      !installation ||
-      !enabled ||
-      providerFailed ||
-      (!registrationComplete() && !embedOnly()) ||
-      owners.size !== 1 ||
-      consentLoaderStatus(driver).reloadRequired
-    )
-      return
-    if (!adapter && !embedOnly()) {
-      if (installation.provider === 'cookiescript') {
-        if ((window as Window & { CookieScript?: unknown }).CookieScript !== undefined) {
-          providerFailed = true
-          providerError =
-            'CookieScript ownership conflicts with an already installed provider. Correct setup and reload.'
-          reconcile()
-          return
-        }
-        adapter = cookieScriptAdapter(window)
-      } else {
-        if (!validRegistration(registration)) {
-          providerError =
-            'Custom consent registration is incomplete. Supply one adapter or a preferences callback.'
-          reconcile()
-          return
-        }
-        adapter = customConsentAdapter(window, registration)
-      }
-    }
-    const wasSubscribed = !!unsubscribe
-    subscribe() // subscription and immediate read precede insertion
-    if (providerFailed) return
-    if (!attempted) {
-      script = window.document.createElement('script')
-      script.async = true
-      script.src = installation.scriptURL!
-      script.dataset.u90ConsentProvider = installation.provider
-      const ownedScript = script
-      loadTimer = window.setTimeout(() => {
-        if (script !== ownedScript) return
-        providerFailed = true
-        raw = deniedConsentState()
-        providerError = 'Consent provider load timed out. Reload after checking setup.'
-        requireConsentReload(driver, providerError)
-        reconcile()
-      }, CONSENT_LOAD_TIMEOUT_MS)
-      script.onload = () => {
-        if (script !== ownedScript) return
-        window.clearTimeout(loadTimer)
-        loadTimer = undefined
-        if (!providerFailed && adapter) {
-          readAdapter()
-          watchReadiness()
-        }
-      }
-      script.onerror = () => {
-        if (script !== ownedScript) return
-        window.clearTimeout(loadTimer)
-        loadTimer = undefined
-        providerFailed = true
-        providerError = 'Consent provider failed to load. Retry consent setup.'
-        raw = deniedConsentState()
-        script?.remove()
-        script = undefined
-        clearTimer()
-        reconcile()
-      }
-      attempted = true
-      window.document.head.appendChild(script)
-    }
-    if (adapter && !wasSubscribed) watchReadiness()
-  }
-  return {
-    read: () => snapshot,
-    subscribe(listener: () => void) {
-      listeners.add(listener)
-      return () => {
-        listeners.delete(listener)
-      }
-    },
-    attach(owner: object) {
-      owners.add(owner)
-      driver.suspend(true)
-    },
-    detach(owner: object) {
-      owners.delete(owner)
-      driver.suspend(true)
-      // StrictMode's same-turn replay retains installation; a lasting owner loss revokes.
-      queueMicrotask(() => {
-        if (owners.size === 0) {
-          disconnect()
-          reconcile()
-        }
-      })
-    },
-    commit(
-      owner: object,
-      nextEndpoint: string,
-      nextEnabled: boolean,
-      input?: ConsentInstallation,
-      custom?: CustomConsentRegistration,
-    ) {
-      if (!owners.has(owner)) return
-      const parsed = input === undefined ? null : ConsentInstallationSchema.safeParse(input)
-      const next = parsed?.success ? parsed.data : undefined
-      if (endpoint !== undefined && endpoint !== nextEndpoint) {
-        disconnect()
-        enabled = false
-        reconcile()
-        if (activated || attempted || driver.attempted())
-          requireConsentReload(
-            driver,
-            'Reload to apply consent changes. The site consent authority changed.',
-          )
-        else {
-          adapter = undefined
-          installed = undefined
-        }
-      }
-      endpoint = nextEndpoint
-      if (next && installation?.googleMode !== next.googleMode && driver.googleAttempted())
-        requireConsentReload(
-          driver,
-          'Reload to apply consent changes. Google consent mode changed.',
-        )
-      installation = next
-      registration = custom
-      enabled = !!nextEnabled && !!next && next.provider !== 'none'
-      driver.suspend(owners.size !== 1)
-      if (enabled) {
-        const nextIdentity = identity(nextEndpoint, next!, custom)
-        if (installed && !same(installed, nextIdentity)) {
-          disconnect()
-          providerFailed = true
-          if (activated || attempted)
-            requireConsentReload(
-              driver,
-              'Reload to apply consent changes. The consent provider or registration changed.',
-            )
-          else {
-            adapter = undefined
-            installed = undefined
-            providerFailed = false
-          }
-        }
-        if (!installed) installed = nextIdentity
-        if (!consentLoaderStatus(driver).reloadRequired) install()
-      }
-      if (!enabled) {
-        raw = deniedConsentState()
-        providerError = parsed && !parsed.success ? 'Consent installation is invalid.' : null
-      }
-      driver.suspend(owners.size !== 1)
-      if (enabled && !providerFailed && unsubscribe) readAdapter()
-      else reconcile()
-    },
-    page(path: string) {
-      driver.page(path)
-    },
-    openPreferences() {
-      // Existing CMP controls remain necessary UI even after disable or reload latch.
-      try {
-        if (!adapter || !ConsentStateSchema.parse(adapter.read()).ready || providerFailed)
-          throw Error('unavailable')
-        adapter.openPreferences()
-        readAdapter()
-      } catch {
-        raw = deniedConsentState()
-        providerError = 'Cookie preferences are unavailable. Retry consent setup.'
-        reconcile()
-      }
-    },
-    retry() {
-      if (consentLoaderStatus(driver).reloadRequired) return
-      if (enabled && (providerFailed || !raw.ready)) {
-        // A wrapper may have caught subscribe() failure while still returning cleanup.
-        // Retry that same authority from a fresh subscription, retaining its installation.
-        disconnect()
-      }
-      if (providerFailed && attempted && !script) attempted = false
-      providerFailed = false
-      providerError = null
-      install()
-      readAdapter()
-    },
-  }
-}

package/src/features/contracts/consent.ts

@@ -1,150 +0,0 @@
-import { z } from 'zod'
-
-export type ConsentState = {
-  version: 1
-  necessary: true
-  preferences: boolean
-  analytics: boolean
-  marketing: boolean
-  ready: boolean
-}
-export type ConsentAdapter = {
-  read(): ConsentState
-  subscribe(listener: (state: ConsentState) => void): () => void
-  openPreferences(): void
-}
-export type ConsentCategory = 'preferences' | 'analytics' | 'marketing'
-export type ManagedIntegration = {
-  id: string
-  src: string
-  category: ConsentCategory
-  attributes?: Record<string, string>
-  revocation: 'stop' | 'reload'
-}
-export type ConsentInstallation = {
-  provider: 'none' | 'cookiescript' | 'custom'
-  scriptURL?: string
-  integrations: ManagedIntegration[]
-  googleMode: 'basic' | 'advanced'
-}
-export type IntegrationDriver = {
-  start(integration: ManagedIntegration): Promise<void>
-  stop(id: string): Promise<'stopped' | 'reload-required'>
-}
-
-/** Always allocate a new snapshot so consumers cannot mutate shared denial. */
-export function deniedConsentState(): ConsentState {
-  return { version: 1, necessary: true, preferences: false, analytics: false, marketing: false, ready: false }
-}
-export const ConsentStateSchema = z.strictObject({
-  version: z.literal(1), necessary: z.literal(true),
-  preferences: z.boolean(), analytics: z.boolean(), marketing: z.boolean(), ready: z.boolean(),
-}).transform((state): ConsentState => state.ready ? state : deniedConsentState())
-
-/** URL parsing must not silently discard raw controls, fragments, or backslashes. */
-const HTTPSURLSchema = z.string().max(2048).refine((source) => {
-  if (/[\s\\#]/.test(source)) return false
-  try {
-    const url = new URL(source)
-    return url.protocol === 'https:' && !!url.hostname && !url.username && !url.password && !source.includes('@')
-  } catch { return false }
-}, 'Expected an HTTPS URL without userinfo, fragments, whitespace or backslashes.')
-  .transform((source) => new URL(source).href)
-
-export function isCookieScriptURL(source: string): boolean {
-  const parsed = HTTPSURLSchema.safeParse(source)
-  return parsed.success && /^https:\/\/(?:cdn|dev-cdn)\.cookie-script\.com\/s\/[a-fA-F0-9]{32}\.js$/.test(parsed.data)
-}
-const ElementIdSchema = z.string().min(1).max(128).regex(/^[A-Za-z][A-Za-z0-9_:.-]*$/)
-// Only standard attributes are shipped. No data-* key is approved for this release.
-const AttributesSchema = z.strictObject({
-  id: ElementIdSchema.optional(),
-  charset: z.string().max(40).regex(/^[A-Za-z0-9._-]+$/).transform((value) => value.toLowerCase()).optional(),
-  crossorigin: z.enum(['anonymous', 'use-credentials']).optional(),
-  integrity: z.string().max(1024).refine((value) => value.split(' ').every((token) =>
-    /^sha256-[A-Za-z0-9+/]{43}=$/.test(token) ||
-    /^sha384-[A-Za-z0-9+/]{64}$/.test(token) ||
-    /^sha512-[A-Za-z0-9+/]{86}==$/.test(token)), 'Expected SHA-256, SHA-384 or SHA-512 SRI digests.').optional(),
-})
-const IntegrationFields = z.strictObject({
-  id: z.string().trim().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9_.:-]*$/),
-  src: HTTPSURLSchema,
-  category: z.enum(['preferences', 'analytics', 'marketing']),
-  attributes: AttributesSchema.optional(),
-  revocation: z.enum(['stop', 'reload']),
-})
-export const ManagedIntegrationSchema = IntegrationFields
-const InstallationFields = z.strictObject({
-  provider: z.enum(['none', 'cookiescript', 'custom']),
-  scriptURL: HTTPSURLSchema.optional(),
-  integrations: z.array(ManagedIntegrationSchema).max(100).default([]),
-  googleMode: z.enum(['basic', 'advanced']).default('basic'),
-})
-function validateInstallation(value: ConsentInstallation, context: z.RefinementCtx) {
-  if (value.provider !== 'none' && !value.scriptURL) {
-    context.addIssue({ code: 'custom', path: ['scriptURL'], message: 'An active provider requires an installation URL.' })
-  } else if (value.provider === 'none' && value.scriptURL) {
-    context.addIssue({ code: 'custom', path: ['scriptURL'], message: 'No provider cannot install a script.' })
-  } else if (value.provider === 'cookiescript' && !isCookieScriptURL(value.scriptURL!)) {
-    context.addIssue({ code: 'custom', path: ['scriptURL'], message: 'Use a direct global CookieScript production or staging installation; geographic wrappers are unsupported.' })
-  }
-  const ids = new Set<string>()
-  value.integrations.forEach((integration, index) => {
-    if (ids.has(integration.id)) context.addIssue({ code: 'custom', path: ['integrations', index, 'id'], message: 'Integration IDs must be unique within the site.' })
-    ids.add(integration.id)
-  })
-}
-export const ConsentInstallationSchema = InstallationFields.superRefine(validateInstallation)
-/** Readers tolerate additive fields but retain only known validated installation data. */
-export const PublicConsentInstallationSchema = InstallationFields.loose().extend({
-  integrations: z.array(IntegrationFields.loose().transform((row) => ManagedIntegrationSchema.parse({
-    id: row.id, src: row.src, category: row.category, revocation: row.revocation,
-    ...(row.attributes ? { attributes: row.attributes } : {}),
-  }))).max(100).default([]),
-}).superRefine(validateInstallation).transform((row) => ConsentInstallationSchema.parse({
-  provider: row.provider, ...(row.scriptURL ? { scriptURL: row.scriptURL } : {}),
-  integrations: row.integrations, googleMode: row.googleMode,
-}))
-
-export type ManagedIntegrationClassification =
-  | { kind: 'ga4'; measurementId: string }
-  | { kind: 'contentsquare'; tagId: string }
-  | { kind: 'custom' }
-/** Shared by permissions and drivers. Caller IDs and known hosts confer no authority. */
-export function classifyManagedIntegration(input: unknown): ManagedIntegrationClassification {
-  const parsed = ManagedIntegrationSchema.safeParse(input)
-  if (!parsed.success) return { kind: 'custom' }
-  const row = parsed.data
-  if (row.category !== 'analytics' ||
-    (row.attributes?.charset !== undefined && row.attributes.charset !== 'utf-8') ||
-    (row.attributes?.crossorigin !== undefined && row.attributes.crossorigin !== 'anonymous')) return { kind: 'custom' }
-  // The 1–32 suffix bound is a U90 supported-input limit, not vendor certification.
-  const ga = /^https:\/\/www\.googletagmanager\.com\/gtag\/js\?id=(G-[A-Z0-9]{1,32})$/.exec(row.src)
-  if (ga) return { kind: 'ga4', measurementId: ga[1] }
-  const cs = /^https:\/\/t\.contentsquare\.net\/uxa\/([a-f0-9]{13})\.js$/.exec(row.src)
-  if (cs && row.revocation === 'reload') return { kind: 'contentsquare', tagId: cs[1] }
-  return { kind: 'custom' }
-}
-
-function customConfiguration(installation?: ConsentInstallation): string {
-  if (!installation) return JSON.stringify({ provider: null, integrations: [] })
-  const normalized = ConsentInstallationSchema.parse(installation)
-  return JSON.stringify({
-    provider: normalized.provider === 'custom' ? normalized.scriptURL : null,
-    integrations: normalized.integrations.filter((row) => classifyManagedIntegration(row).kind === 'custom')
-      .sort((a, b) => a.id.localeCompare(b.id)).map((row) => ({
-        id: row.id, src: row.src, category: row.category, revocation: row.revocation,
-        attributes: Object.fromEntries(Object.entries(row.attributes ?? {}).sort(([a], [b]) => a.localeCompare(b))),
-      })),
-  })
-}
-export type ConsentConfiguration = { enabled: boolean; installation?: ConsentInstallation }
-/** The protected writer and all feature toggles must use this same before/after check. */
-export function consentChangeRequiresCodeWrite(before: ConsentConfiguration, after: ConsentConfiguration): boolean {
-  const oldCustom = customConfiguration(before.installation)
-  const newCustom = customConfiguration(after.installation)
-  const wasActive = before.enabled && !!before.installation && before.installation.provider !== 'none'
-  const willBeActive = after.enabled && !!after.installation && after.installation.provider !== 'none'
-  const activates = (!before.enabled && after.enabled) || (!wasActive && willBeActive)
-  return oldCustom !== newCustom || (activates && newCustom !== customConfiguration())
-}

package/src/features/server/ConsentDefaults.tsx

@@ -1,15 +0,0 @@
-import Script from 'next/script'
-import { CONSENT_DEFAULTS_ID, CONSENT_DEFAULTS_SCRIPT } from '../consent/defaults'
-/** Mount once in the consuming server root layout, before SiteFeatures. */
-export function ConsentDefaults() {
-  return (
-    // App Router consumers mount this wrapper in their root layout. This rule
-    // uses the Pages Router _document filename heuristic for reusable packages.
-    // eslint-disable-next-line @next/next/no-before-interactive-script-outside-document
-    <Script
-      id={CONSENT_DEFAULTS_ID}
-      strategy="beforeInteractive"
-      dangerouslySetInnerHTML={{ __html: CONSENT_DEFAULTS_SCRIPT }}
-    />
-  )
-}