@vectoriox/iox-ui 5.4.0 → 5.4.1

package/consent-core/index.d.ts

@@ -55,6 +55,12 @@ declare const CONSENT_DEFAULTS_DENIED: Readonly<Record<(typeof CONSENT_MODE_PARA
 declare function toConsentModeSignals(decision: ConsentDecision | null | undefined): Record<string, ConsentModeSignal>;
 /** The inline `<head>` bootstrap (basic mode, D-C2): defaults denied before anything loads. */
 declare function consentModeBootstrapJs(): string;
+/**
+ * The gated injection, as HTML (C2). Emitted by the SSR server ONLY when the request's cookie
+ * grants analytics AND the org has a measurementId — the bootstrap above is unconditional, this
+ * is not. Order inside: consent UPDATE before the loader, config after it.
+ */
+declare function analyticsInjectionHtml(measurementId: string, decision: ConsentDecision): string;
 
-export { CONSENT_COOKIE_NAME, CONSENT_DEFAULTS_DENIED, CONSENT_MODE_PARAMS, ConsentCategory, consentModeBootstrapJs, cookieAttributes, decode, emptyDecision, encode, hasConsent, isExpired, needsPrompt, toConsentModeSignals };
+export { CONSENT_COOKIE_NAME, CONSENT_DEFAULTS_DENIED, CONSENT_MODE_PARAMS, ConsentCategory, analyticsInjectionHtml, consentModeBootstrapJs, cookieAttributes, decode, emptyDecision, encode, hasConsent, isExpired, needsPrompt, toConsentModeSignals };
 export type { ConsentDecision, ConsentModeSignal };

package/fesm2022/vectoriox-iox-ui-consent-core.mjs

@@ -120,6 +120,22 @@ function consentModeBootstrapJs() {
     return "window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments);}" +
         `gtag('consent','default',${JSON.stringify(CONSENT_DEFAULTS_DENIED)});`;
 }
+/**
+ * The gated injection, as HTML (C2). Emitted by the SSR server ONLY when the request's cookie
+ * grants analytics AND the org has a measurementId — the bootstrap above is unconditional, this
+ * is not. Order inside: consent UPDATE before the loader, config after it.
+ */
+function analyticsInjectionHtml(measurementId, decision) {
+    const id = (measurementId ?? '').trim();
+    if (!id || !/^[A-Za-z0-9-]+$/.test(id))
+        return '';
+    if (!hasConsent(decision, ConsentCategory.Analytics))
+        return '';
+    const signals = JSON.stringify(toConsentModeSignals(decision));
+    return `<script>gtag('consent','update',${signals});</script>` +
+        `<script async src="https://www.googletagmanager.com/gtag/js?id=${id}"></script>` +
+        `<script>gtag('js',new Date());gtag('config','${id}');</script>`;
+}
 
 /**
  * @vectoriox/iox-ui/consent-core — the shared, FRAMEWORK-FREE core of visitor consent.
@@ -137,5 +153,5 @@ function consentModeBootstrapJs() {
  * Generated bundle index. Do not edit.
  */
 
-export { CONSENT_COOKIE_NAME, CONSENT_DEFAULTS_DENIED, CONSENT_MODE_PARAMS, ConsentCategory, consentModeBootstrapJs, cookieAttributes, decode, emptyDecision, encode, hasConsent, isExpired, needsPrompt, toConsentModeSignals };
+export { CONSENT_COOKIE_NAME, CONSENT_DEFAULTS_DENIED, CONSENT_MODE_PARAMS, ConsentCategory, analyticsInjectionHtml, consentModeBootstrapJs, cookieAttributes, decode, emptyDecision, encode, hasConsent, isExpired, needsPrompt, toConsentModeSignals };
 //# sourceMappingURL=vectoriox-iox-ui-consent-core.mjs.map

package/fesm2022/vectoriox-iox-ui-consent-core.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"vectoriox-iox-ui-consent-core.mjs","sources":["../../../projects/iox-ui/src/consent-core/consent.model.ts","../../../projects/iox-ui/src/consent-core/storage.ts","../../../projects/iox-ui/src/consent-core/consent-mode.ts","../../../projects/iox-ui/src/consent-core/public-api.ts","../../../projects/iox-ui/src/consent-core/vectoriox-iox-ui-consent-core.ts"],"sourcesContent":["/**\n * The visitor-consent vocabulary (consent plan C1). Framework-free for the same forced reason as\n * forms-core/seo-core/actions-core: iox-cms consumes it under plain Node, the engine at SSR time,\n * the builder for design-time preview — ONE implementation of what a decision is.\n */\n\nexport enum ConsentCategory {\n    /** Always on, never user-controllable — the site working at all. */\n    Necessary = 'necessary',\n    Analytics = 'analytics',\n    Marketing = 'marketing',\n}\n\n/** A visitor's recorded decision. `necessary` is implied true and never stored as false. */\nexport interface ConsentDecision {\n    categories: Partial<Record<ConsentCategory, boolean>>;\n    /** Bumping the org's policy version invalidates every prior decision. */\n    policyVersion: string;\n    /** ISO timestamp of the decision. */\n    decidedAt: string;\n    anonymousId: string;\n}\n\n/** A fresh \"nothing granted\" decision skeleton — used when a visitor must be asked. */\nexport function emptyDecision(anonymousId: string, policyVersion: string, now: Date = new Date()): ConsentDecision {\n    return {\n        categories: { [ConsentCategory.Necessary]: true },\n        policyVersion,\n        decidedAt: now.toISOString(),\n        anonymousId,\n    };\n}\n\n/** `null` (no decision yet) grants nothing; `necessary` is always granted. */\nexport function hasConsent(decision: ConsentDecision | null | undefined, category: ConsentCategory): boolean {\n    if (category === ConsentCategory.Necessary) return true;\n    if (!decision) return false;\n    return decision.categories?.[category] === true;\n}\n\n/** A decision older than `maxMonths` no longer counts (default re-ask: 12 months, D-C6). */\nexport function isExpired(decision: ConsentDecision, now: Date, maxMonths: number): boolean {\n    const decided = new Date(decision.decidedAt);\n    if (Number.isNaN(decided.getTime())) return true;\n    const expiry = new Date(decided);\n    expiry.setMonth(expiry.getMonth() + maxMonths);\n    return now >= expiry;\n}\n\n/**\n * The function the dead fork got wrong: **a recorded \"no\" is a decision.** The banner shows only\n * when there is no decision, the decision expired, or the policy version moved on — never because\n * the visitor declined.\n */\nexport function needsPrompt(\n    decision: ConsentDecision | null | undefined,\n    policyVersion: string,\n    now: Date = new Date(),\n    maxMonths = 12,\n): boolean {\n    if (!decision) return true;\n    if (decision.policyVersion !== policyVersion) return true;\n    return isExpired(decision, now, maxMonths);\n}\n","import { ConsentCategory, ConsentDecision } from './consent.model';\n\n/** First-party cookie name — the visitor's browser carries the proof (D-C1). */\nexport const CONSENT_COOKIE_NAME = 'iox-consent';\n\n/** Cookie payload. Versioned so a future shape change can read old cookies tolerantly. */\nexport function encode(decision: ConsentDecision): string {\n    return JSON.stringify({ v: 1, ...decision });\n}\n\n/**\n * Tolerant by contract: bad JSON, a foreign shape, a tampered cookie — all read as `null`\n * (\"no decision\"), never a throw and never a guess. The old fork threw its way to a re-prompt.\n */\nexport function decode(raw: string | null | undefined): ConsentDecision | null {\n    if (!raw) return null;\n    try {\n        const parsed = JSON.parse(raw);\n        if (!parsed || typeof parsed !== 'object') return null;\n        if (typeof parsed.anonymousId !== 'string' || !parsed.anonymousId) return null;\n        if (typeof parsed.policyVersion !== 'string') return null;\n        if (!parsed.categories || typeof parsed.categories !== 'object' || Array.isArray(parsed.categories)) return null;\n        const categories: Partial<Record<ConsentCategory, boolean>> = {};\n        for (const [k, v] of Object.entries(parsed.categories)) {\n            categories[k as ConsentCategory] = v === true;\n        }\n        categories[ConsentCategory.Necessary] = true;\n        return {\n            categories,\n            policyVersion: parsed.policyVersion,\n            decidedAt: typeof parsed.decidedAt === 'string' ? parsed.decidedAt : '',\n            anonymousId: parsed.anonymousId,\n        };\n    } catch {\n        return null;\n    }\n}\n\n/** `Set-Cookie` attributes for the decision: a NECESSARY cookie, 12 months, first-party. */\nexport function cookieAttributes(maxMonths = 12): string {\n    const maxAge = Math.floor(maxMonths * 30.44 * 24 * 60 * 60);\n    return `Path=/; Max-Age=${maxAge}; SameSite=Lax; Secure`;\n}\n","import { ConsentCategory, ConsentDecision, hasConsent } from './consent.model';\n\n/**\n * Google Consent Mode v2 (consent plan §4): four parameters, mandatory for EEA/UK measurement\n * since March 2024. Our categories map onto them; `necessary` maps to none.\n */\nexport type ConsentModeSignal = 'granted' | 'denied';\n\nexport const CONSENT_MODE_PARAMS = [\n    'analytics_storage', 'ad_storage', 'ad_user_data', 'ad_personalization',\n] as const;\n\n/** What the SSR head declares BEFORE any tag can load (invariant I1): everything denied. */\nexport const CONSENT_DEFAULTS_DENIED: Readonly<Record<(typeof CONSENT_MODE_PARAMS)[number], ConsentModeSignal>> =\n    Object.freeze({\n        analytics_storage: 'denied',\n        ad_storage: 'denied',\n        ad_user_data: 'denied',\n        ad_personalization: 'denied',\n    });\n\n/** A decision → the four v2 signals. `null` (undecided) is indistinguishable from denied. */\nexport function toConsentModeSignals(decision: ConsentDecision | null | undefined): Record<string, ConsentModeSignal> {\n    const analytics: ConsentModeSignal = hasConsent(decision ?? null, ConsentCategory.Analytics) ? 'granted' : 'denied';\n    const marketing: ConsentModeSignal = hasConsent(decision ?? null, ConsentCategory.Marketing) ? 'granted' : 'denied';\n    return {\n        analytics_storage: analytics,\n        ad_storage: marketing,\n        ad_user_data: marketing,\n        ad_personalization: marketing,\n    };\n}\n\n/** The inline `<head>` bootstrap (basic mode, D-C2): defaults denied before anything loads. */\nexport function consentModeBootstrapJs(): string {\n    return \"window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments);}\" +\n        `gtag('consent','default',${JSON.stringify(CONSENT_DEFAULTS_DENIED)});`;\n}\n","/**\n * @vectoriox/iox-ui/consent-core — the shared, FRAMEWORK-FREE core of visitor consent.\n *\n * What a decision IS (`needsPrompt`: a recorded \"no\" is a decision), how it travels (a tolerant\n * first-party cookie), and what it tells Google (Consent Mode v2 signals, denied-by-default).\n * Consumed by the SSR engine (the gate, C2), the builder (banner preview, C3) and iox-cms (the\n * optional per-org log, C4) — the fourth entry point on the forms-core pattern, replacing the\n * dead byte-identical fork C0 deleted.\n * ⚠️ Consumers wire the usual trio — ng-package raw-ts assets, jest moduleNameMapper, tsconfig\n * paths — or `nest start` dies with ERR_REQUIRE_ESM while jest and build both pass.\n */\nexport * from './consent.model';\nexport * from './storage';\nexport * from './consent-mode';\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './public-api';\n"],"names":[],"mappings":"AAAA;;;;AAIG;IAES;AAAZ,CAAA,UAAY,eAAe,EAAA;;AAEvB,IAAA,eAAA,CAAA,WAAA,CAAA,GAAA,WAAuB;AACvB,IAAA,eAAA,CAAA,WAAA,CAAA,GAAA,WAAuB;AACvB,IAAA,eAAA,CAAA,WAAA,CAAA,GAAA,WAAuB;AAC3B,CAAC,EALW,eAAe,KAAf,eAAe,GAAA,EAAA,CAAA,CAAA;AAiB3B;AACM,SAAU,aAAa,CAAC,WAAmB,EAAE,aAAqB,EAAE,GAAA,GAAY,IAAI,IAAI,EAAE,EAAA;IAC5F,OAAO;QACH,UAAU,EAAE,EAAE,CAAC,eAAe,CAAC,SAAS,GAAG,IAAI,EAAE;QACjD,aAAa;AACb,QAAA,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,WAAW;KACd;AACL;AAEA;AACM,SAAU,UAAU,CAAC,QAA4C,EAAE,QAAyB,EAAA;AAC9F,IAAA,IAAI,QAAQ,KAAK,eAAe,CAAC,SAAS;AAAE,QAAA,OAAO,IAAI;AACvD,IAAA,IAAI,CAAC,QAAQ;AAAE,QAAA,OAAO,KAAK;IAC3B,OAAO,QAAQ,CAAC,UAAU,GAAG,QAAQ,CAAC,KAAK,IAAI;AACnD;AAEA;SACgB,SAAS,CAAC,QAAyB,EAAE,GAAS,EAAE,SAAiB,EAAA;IAC7E,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;IAC5C,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;AAAE,QAAA,OAAO,IAAI;AAChD,IAAA,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC;IAChC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,SAAS,CAAC;IAC9C,OAAO,GAAG,IAAI,MAAM;AACxB;AAEA;;;;AAIG;AACG,SAAU,WAAW,CACvB,QAA4C,EAC5C,aAAqB,EACrB,GAAA,GAAY,IAAI,IAAI,EAAE,EACtB,SAAS,GAAG,EAAE,EAAA;AAEd,IAAA,IAAI,CAAC,QAAQ;AAAE,QAAA,OAAO,IAAI;AAC1B,IAAA,IAAI,QAAQ,CAAC,aAAa,KAAK,aAAa;AAAE,QAAA,OAAO,IAAI;IACzD,OAAO,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC;AAC9C;;AC7DA;AACO,MAAM,mBAAmB,GAAG;AAEnC;AACM,SAAU,MAAM,CAAC,QAAyB,EAAA;AAC5C,IAAA,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC;AAChD;AAEA;;;AAGG;AACG,SAAU,MAAM,CAAC,GAA8B,EAAA;AACjD,IAAA,IAAI,CAAC,GAAG;AAAE,QAAA,OAAO,IAAI;AACrB,IAAA,IAAI;QACA,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;AAC9B,QAAA,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;AAAE,YAAA,OAAO,IAAI;QACtD,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,WAAW;AAAE,YAAA,OAAO,IAAI;AAC9E,QAAA,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;AAAE,YAAA,OAAO,IAAI;AACzD,QAAA,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;AAAE,YAAA,OAAO,IAAI;QAChH,MAAM,UAAU,GAA8C,EAAE;AAChE,QAAA,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE;AACpD,YAAA,UAAU,CAAC,CAAoB,CAAC,GAAG,CAAC,KAAK,IAAI;QACjD;AACA,QAAA,UAAU,CAAC,eAAe,CAAC,SAAS,CAAC,GAAG,IAAI;QAC5C,OAAO;YACH,UAAU;YACV,aAAa,EAAE,MAAM,CAAC,aAAa;AACnC,YAAA,SAAS,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,GAAG,MAAM,CAAC,SAAS,GAAG,EAAE;YACvE,WAAW,EAAE,MAAM,CAAC,WAAW;SAClC;IACL;AAAE,IAAA,MAAM;AACJ,QAAA,OAAO,IAAI;IACf;AACJ;AAEA;AACM,SAAU,gBAAgB,CAAC,SAAS,GAAG,EAAE,EAAA;AAC3C,IAAA,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IAC3D,OAAO,CAAA,gBAAA,EAAmB,MAAM,CAAA,sBAAA,CAAwB;AAC5D;;AClCO,MAAM,mBAAmB,GAAG;AAC/B,IAAA,mBAAmB,EAAE,YAAY,EAAE,cAAc,EAAE,oBAAoB;;AAG3E;AACO,MAAM,uBAAuB,GAChC,MAAM,CAAC,MAAM,CAAC;AACV,IAAA,iBAAiB,EAAE,QAAQ;AAC3B,IAAA,UAAU,EAAE,QAAQ;AACpB,IAAA,YAAY,EAAE,QAAQ;AACtB,IAAA,kBAAkB,EAAE,QAAQ;AAC/B,CAAA;AAEL;AACM,SAAU,oBAAoB,CAAC,QAA4C,EAAA;IAC7E,MAAM,SAAS,GAAsB,UAAU,CAAC,QAAQ,IAAI,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,GAAG,SAAS,GAAG,QAAQ;IACnH,MAAM,SAAS,GAAsB,UAAU,CAAC,QAAQ,IAAI,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,GAAG,SAAS,GAAG,QAAQ;IACnH,OAAO;AACH,QAAA,iBAAiB,EAAE,SAAS;AAC5B,QAAA,UAAU,EAAE,SAAS;AACrB,QAAA,YAAY,EAAE,SAAS;AACvB,QAAA,kBAAkB,EAAE,SAAS;KAChC;AACL;AAEA;SACgB,sBAAsB,GAAA;AAClC,IAAA,OAAO,mFAAmF;AACtF,QAAA,CAAA,yBAAA,EAA4B,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,IAAI;AAC/E;;ACrCA;;;;;;;;;;AAUG;;ACVH;;AAEG;;;;"}
+{"version":3,"file":"vectoriox-iox-ui-consent-core.mjs","sources":["../../../projects/iox-ui/src/consent-core/consent.model.ts","../../../projects/iox-ui/src/consent-core/storage.ts","../../../projects/iox-ui/src/consent-core/consent-mode.ts","../../../projects/iox-ui/src/consent-core/public-api.ts","../../../projects/iox-ui/src/consent-core/vectoriox-iox-ui-consent-core.ts"],"sourcesContent":["/**\n * The visitor-consent vocabulary (consent plan C1). Framework-free for the same forced reason as\n * forms-core/seo-core/actions-core: iox-cms consumes it under plain Node, the engine at SSR time,\n * the builder for design-time preview — ONE implementation of what a decision is.\n */\n\nexport enum ConsentCategory {\n    /** Always on, never user-controllable — the site working at all. */\n    Necessary = 'necessary',\n    Analytics = 'analytics',\n    Marketing = 'marketing',\n}\n\n/** A visitor's recorded decision. `necessary` is implied true and never stored as false. */\nexport interface ConsentDecision {\n    categories: Partial<Record<ConsentCategory, boolean>>;\n    /** Bumping the org's policy version invalidates every prior decision. */\n    policyVersion: string;\n    /** ISO timestamp of the decision. */\n    decidedAt: string;\n    anonymousId: string;\n}\n\n/** A fresh \"nothing granted\" decision skeleton — used when a visitor must be asked. */\nexport function emptyDecision(anonymousId: string, policyVersion: string, now: Date = new Date()): ConsentDecision {\n    return {\n        categories: { [ConsentCategory.Necessary]: true },\n        policyVersion,\n        decidedAt: now.toISOString(),\n        anonymousId,\n    };\n}\n\n/** `null` (no decision yet) grants nothing; `necessary` is always granted. */\nexport function hasConsent(decision: ConsentDecision | null | undefined, category: ConsentCategory): boolean {\n    if (category === ConsentCategory.Necessary) return true;\n    if (!decision) return false;\n    return decision.categories?.[category] === true;\n}\n\n/** A decision older than `maxMonths` no longer counts (default re-ask: 12 months, D-C6). */\nexport function isExpired(decision: ConsentDecision, now: Date, maxMonths: number): boolean {\n    const decided = new Date(decision.decidedAt);\n    if (Number.isNaN(decided.getTime())) return true;\n    const expiry = new Date(decided);\n    expiry.setMonth(expiry.getMonth() + maxMonths);\n    return now >= expiry;\n}\n\n/**\n * The function the dead fork got wrong: **a recorded \"no\" is a decision.** The banner shows only\n * when there is no decision, the decision expired, or the policy version moved on — never because\n * the visitor declined.\n */\nexport function needsPrompt(\n    decision: ConsentDecision | null | undefined,\n    policyVersion: string,\n    now: Date = new Date(),\n    maxMonths = 12,\n): boolean {\n    if (!decision) return true;\n    if (decision.policyVersion !== policyVersion) return true;\n    return isExpired(decision, now, maxMonths);\n}\n","import { ConsentCategory, ConsentDecision } from './consent.model';\n\n/** First-party cookie name — the visitor's browser carries the proof (D-C1). */\nexport const CONSENT_COOKIE_NAME = 'iox-consent';\n\n/** Cookie payload. Versioned so a future shape change can read old cookies tolerantly. */\nexport function encode(decision: ConsentDecision): string {\n    return JSON.stringify({ v: 1, ...decision });\n}\n\n/**\n * Tolerant by contract: bad JSON, a foreign shape, a tampered cookie — all read as `null`\n * (\"no decision\"), never a throw and never a guess. The old fork threw its way to a re-prompt.\n */\nexport function decode(raw: string | null | undefined): ConsentDecision | null {\n    if (!raw) return null;\n    try {\n        const parsed = JSON.parse(raw);\n        if (!parsed || typeof parsed !== 'object') return null;\n        if (typeof parsed.anonymousId !== 'string' || !parsed.anonymousId) return null;\n        if (typeof parsed.policyVersion !== 'string') return null;\n        if (!parsed.categories || typeof parsed.categories !== 'object' || Array.isArray(parsed.categories)) return null;\n        const categories: Partial<Record<ConsentCategory, boolean>> = {};\n        for (const [k, v] of Object.entries(parsed.categories)) {\n            categories[k as ConsentCategory] = v === true;\n        }\n        categories[ConsentCategory.Necessary] = true;\n        return {\n            categories,\n            policyVersion: parsed.policyVersion,\n            decidedAt: typeof parsed.decidedAt === 'string' ? parsed.decidedAt : '',\n            anonymousId: parsed.anonymousId,\n        };\n    } catch {\n        return null;\n    }\n}\n\n/** `Set-Cookie` attributes for the decision: a NECESSARY cookie, 12 months, first-party. */\nexport function cookieAttributes(maxMonths = 12): string {\n    const maxAge = Math.floor(maxMonths * 30.44 * 24 * 60 * 60);\n    return `Path=/; Max-Age=${maxAge}; SameSite=Lax; Secure`;\n}\n","import { ConsentCategory, ConsentDecision, hasConsent } from './consent.model';\n\n/**\n * Google Consent Mode v2 (consent plan §4): four parameters, mandatory for EEA/UK measurement\n * since March 2024. Our categories map onto them; `necessary` maps to none.\n */\nexport type ConsentModeSignal = 'granted' | 'denied';\n\nexport const CONSENT_MODE_PARAMS = [\n    'analytics_storage', 'ad_storage', 'ad_user_data', 'ad_personalization',\n] as const;\n\n/** What the SSR head declares BEFORE any tag can load (invariant I1): everything denied. */\nexport const CONSENT_DEFAULTS_DENIED: Readonly<Record<(typeof CONSENT_MODE_PARAMS)[number], ConsentModeSignal>> =\n    Object.freeze({\n        analytics_storage: 'denied',\n        ad_storage: 'denied',\n        ad_user_data: 'denied',\n        ad_personalization: 'denied',\n    });\n\n/** A decision → the four v2 signals. `null` (undecided) is indistinguishable from denied. */\nexport function toConsentModeSignals(decision: ConsentDecision | null | undefined): Record<string, ConsentModeSignal> {\n    const analytics: ConsentModeSignal = hasConsent(decision ?? null, ConsentCategory.Analytics) ? 'granted' : 'denied';\n    const marketing: ConsentModeSignal = hasConsent(decision ?? null, ConsentCategory.Marketing) ? 'granted' : 'denied';\n    return {\n        analytics_storage: analytics,\n        ad_storage: marketing,\n        ad_user_data: marketing,\n        ad_personalization: marketing,\n    };\n}\n\n/** The inline `<head>` bootstrap (basic mode, D-C2): defaults denied before anything loads. */\nexport function consentModeBootstrapJs(): string {\n    return \"window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments);}\" +\n        `gtag('consent','default',${JSON.stringify(CONSENT_DEFAULTS_DENIED)});`;\n}\n\n/**\n * The gated injection, as HTML (C2). Emitted by the SSR server ONLY when the request's cookie\n * grants analytics AND the org has a measurementId — the bootstrap above is unconditional, this\n * is not. Order inside: consent UPDATE before the loader, config after it.\n */\nexport function analyticsInjectionHtml(measurementId: string, decision: ConsentDecision): string {\n    const id = (measurementId ?? '').trim();\n    if (!id || !/^[A-Za-z0-9-]+$/.test(id)) return '';\n    if (!hasConsent(decision, ConsentCategory.Analytics)) return '';\n    const signals = JSON.stringify(toConsentModeSignals(decision));\n    return `<script>gtag('consent','update',${signals});</script>` +\n        `<script async src=\"https://www.googletagmanager.com/gtag/js?id=${id}\"></script>` +\n        `<script>gtag('js',new Date());gtag('config','${id}');</script>`;\n}\n","/**\n * @vectoriox/iox-ui/consent-core — the shared, FRAMEWORK-FREE core of visitor consent.\n *\n * What a decision IS (`needsPrompt`: a recorded \"no\" is a decision), how it travels (a tolerant\n * first-party cookie), and what it tells Google (Consent Mode v2 signals, denied-by-default).\n * Consumed by the SSR engine (the gate, C2), the builder (banner preview, C3) and iox-cms (the\n * optional per-org log, C4) — the fourth entry point on the forms-core pattern, replacing the\n * dead byte-identical fork C0 deleted.\n * ⚠️ Consumers wire the usual trio — ng-package raw-ts assets, jest moduleNameMapper, tsconfig\n * paths — or `nest start` dies with ERR_REQUIRE_ESM while jest and build both pass.\n */\nexport * from './consent.model';\nexport * from './storage';\nexport * from './consent-mode';\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './public-api';\n"],"names":[],"mappings":"AAAA;;;;AAIG;IAES;AAAZ,CAAA,UAAY,eAAe,EAAA;;AAEvB,IAAA,eAAA,CAAA,WAAA,CAAA,GAAA,WAAuB;AACvB,IAAA,eAAA,CAAA,WAAA,CAAA,GAAA,WAAuB;AACvB,IAAA,eAAA,CAAA,WAAA,CAAA,GAAA,WAAuB;AAC3B,CAAC,EALW,eAAe,KAAf,eAAe,GAAA,EAAA,CAAA,CAAA;AAiB3B;AACM,SAAU,aAAa,CAAC,WAAmB,EAAE,aAAqB,EAAE,GAAA,GAAY,IAAI,IAAI,EAAE,EAAA;IAC5F,OAAO;QACH,UAAU,EAAE,EAAE,CAAC,eAAe,CAAC,SAAS,GAAG,IAAI,EAAE;QACjD,aAAa;AACb,QAAA,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,WAAW;KACd;AACL;AAEA;AACM,SAAU,UAAU,CAAC,QAA4C,EAAE,QAAyB,EAAA;AAC9F,IAAA,IAAI,QAAQ,KAAK,eAAe,CAAC,SAAS;AAAE,QAAA,OAAO,IAAI;AACvD,IAAA,IAAI,CAAC,QAAQ;AAAE,QAAA,OAAO,KAAK;IAC3B,OAAO,QAAQ,CAAC,UAAU,GAAG,QAAQ,CAAC,KAAK,IAAI;AACnD;AAEA;SACgB,SAAS,CAAC,QAAyB,EAAE,GAAS,EAAE,SAAiB,EAAA;IAC7E,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;IAC5C,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;AAAE,QAAA,OAAO,IAAI;AAChD,IAAA,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC;IAChC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,SAAS,CAAC;IAC9C,OAAO,GAAG,IAAI,MAAM;AACxB;AAEA;;;;AAIG;AACG,SAAU,WAAW,CACvB,QAA4C,EAC5C,aAAqB,EACrB,GAAA,GAAY,IAAI,IAAI,EAAE,EACtB,SAAS,GAAG,EAAE,EAAA;AAEd,IAAA,IAAI,CAAC,QAAQ;AAAE,QAAA,OAAO,IAAI;AAC1B,IAAA,IAAI,QAAQ,CAAC,aAAa,KAAK,aAAa;AAAE,QAAA,OAAO,IAAI;IACzD,OAAO,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC;AAC9C;;AC7DA;AACO,MAAM,mBAAmB,GAAG;AAEnC;AACM,SAAU,MAAM,CAAC,QAAyB,EAAA;AAC5C,IAAA,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC;AAChD;AAEA;;;AAGG;AACG,SAAU,MAAM,CAAC,GAA8B,EAAA;AACjD,IAAA,IAAI,CAAC,GAAG;AAAE,QAAA,OAAO,IAAI;AACrB,IAAA,IAAI;QACA,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;AAC9B,QAAA,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;AAAE,YAAA,OAAO,IAAI;QACtD,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,WAAW;AAAE,YAAA,OAAO,IAAI;AAC9E,QAAA,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;AAAE,YAAA,OAAO,IAAI;AACzD,QAAA,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;AAAE,YAAA,OAAO,IAAI;QAChH,MAAM,UAAU,GAA8C,EAAE;AAChE,QAAA,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE;AACpD,YAAA,UAAU,CAAC,CAAoB,CAAC,GAAG,CAAC,KAAK,IAAI;QACjD;AACA,QAAA,UAAU,CAAC,eAAe,CAAC,SAAS,CAAC,GAAG,IAAI;QAC5C,OAAO;YACH,UAAU;YACV,aAAa,EAAE,MAAM,CAAC,aAAa;AACnC,YAAA,SAAS,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,GAAG,MAAM,CAAC,SAAS,GAAG,EAAE;YACvE,WAAW,EAAE,MAAM,CAAC,WAAW;SAClC;IACL;AAAE,IAAA,MAAM;AACJ,QAAA,OAAO,IAAI;IACf;AACJ;AAEA;AACM,SAAU,gBAAgB,CAAC,SAAS,GAAG,EAAE,EAAA;AAC3C,IAAA,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IAC3D,OAAO,CAAA,gBAAA,EAAmB,MAAM,CAAA,sBAAA,CAAwB;AAC5D;;AClCO,MAAM,mBAAmB,GAAG;AAC/B,IAAA,mBAAmB,EAAE,YAAY,EAAE,cAAc,EAAE,oBAAoB;;AAG3E;AACO,MAAM,uBAAuB,GAChC,MAAM,CAAC,MAAM,CAAC;AACV,IAAA,iBAAiB,EAAE,QAAQ;AAC3B,IAAA,UAAU,EAAE,QAAQ;AACpB,IAAA,YAAY,EAAE,QAAQ;AACtB,IAAA,kBAAkB,EAAE,QAAQ;AAC/B,CAAA;AAEL;AACM,SAAU,oBAAoB,CAAC,QAA4C,EAAA;IAC7E,MAAM,SAAS,GAAsB,UAAU,CAAC,QAAQ,IAAI,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,GAAG,SAAS,GAAG,QAAQ;IACnH,MAAM,SAAS,GAAsB,UAAU,CAAC,QAAQ,IAAI,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,GAAG,SAAS,GAAG,QAAQ;IACnH,OAAO;AACH,QAAA,iBAAiB,EAAE,SAAS;AAC5B,QAAA,UAAU,EAAE,SAAS;AACrB,QAAA,YAAY,EAAE,SAAS;AACvB,QAAA,kBAAkB,EAAE,SAAS;KAChC;AACL;AAEA;SACgB,sBAAsB,GAAA;AAClC,IAAA,OAAO,mFAAmF;AACtF,QAAA,CAAA,yBAAA,EAA4B,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,IAAI;AAC/E;AAEA;;;;AAIG;AACG,SAAU,sBAAsB,CAAC,aAAqB,EAAE,QAAyB,EAAA;IACnF,MAAM,EAAE,GAAG,CAAC,aAAa,IAAI,EAAE,EAAE,IAAI,EAAE;IACvC,IAAI,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;AAAE,QAAA,OAAO,EAAE;IACjD,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,eAAe,CAAC,SAAS,CAAC;AAAE,QAAA,OAAO,EAAE;IAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC9D,OAAO,CAAA,gCAAA,EAAmC,OAAO,CAAA,WAAA,CAAa;AAC1D,QAAA,CAAA,+DAAA,EAAkE,EAAE,CAAA,WAAA,CAAa;QACjF,CAAA,6CAAA,EAAgD,EAAE,cAAc;AACxE;;ACpDA;;;;;;;;;;AAUG;;ACVH;;AAEG;;;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vectoriox/iox-ui",
-  "version": "5.4.0",
+  "version": "5.4.1",
   "peerDependencies": {
     "@angular/common": ">=20.0.0",
     "@angular/core": ">=20.0.0",

package/src/consent-core/consent-mode.ts

@@ -36,3 +36,18 @@ export function consentModeBootstrapJs(): string {
     return "window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments);}" +
         `gtag('consent','default',${JSON.stringify(CONSENT_DEFAULTS_DENIED)});`;
 }
+
+/**
+ * The gated injection, as HTML (C2). Emitted by the SSR server ONLY when the request's cookie
+ * grants analytics AND the org has a measurementId — the bootstrap above is unconditional, this
+ * is not. Order inside: consent UPDATE before the loader, config after it.
+ */
+export function analyticsInjectionHtml(measurementId: string, decision: ConsentDecision): string {
+    const id = (measurementId ?? '').trim();
+    if (!id || !/^[A-Za-z0-9-]+$/.test(id)) return '';
+    if (!hasConsent(decision, ConsentCategory.Analytics)) return '';
+    const signals = JSON.stringify(toConsentModeSignals(decision));
+    return `<script>gtag('consent','update',${signals});</script>` +
+        `<script async src="https://www.googletagmanager.com/gtag/js?id=${id}"></script>` +
+        `<script>gtag('js',new Date());gtag('config','${id}');</script>`;
+}