@wix/web5-core 1.63.15 → 1.63.17

package/dist/cjs/privacy/providers/oneTrustProvider.js

@@ -0,0 +1,72 @@
+"use strict";
+
+exports.__esModule = true;
+exports.isOneTrustHost = exports.createOneTrustConsentProvider = void 0;
+/**
+ * OneTrust provider — DL #218.
+ *
+ * Lifted from the consent check that used to live inside
+ * `utils/analyticsEvents.ts`, with one deliberate behaviour change: that
+ * function returned `true` when OneTrust was absent ("host is responsible for
+ * loading OneTrust"), which on a Shopify storefront meant unconditional
+ * default-allow. Absence is no longer this provider's problem — it is only
+ * selected when OneTrust is actually on the page, and absence is handled by
+ * the gate's own default.
+ */
+
+/** OneTrust's default taxonomy: C0002 is the performance/analytics category. */
+const ANALYTICS_CATEGORY = 'C0002';
+/** C0004 is targeting/advertising. */
+const MARKETING_CATEGORY = 'C0004';
+const readGroups = () => {
+  if (typeof window === 'undefined') {
+    return null;
+  }
+  const groups = window.OnetrustActiveGroups;
+  return typeof groups === 'string' ? groups : null;
+};
+const isOneTrustHost = () => readGroups() !== null;
+exports.isOneTrustHost = isOneTrustHost;
+const readSnapshot = () => {
+  const groups = readGroups();
+  if (groups !== null) {
+    try {
+      console.log(`[w5-consent] onetrust: active groups "${groups}"`);
+    } catch {
+      /* never break on a console */
+    }
+  }
+  if (groups === null) {
+    return {
+      analytics: 'unknown',
+      marketing: 'unknown',
+      performance: 'unknown'
+    };
+  }
+  // OneTrust publishes the *active* groups, so a category that is absent from
+  // a string OneTrust has written is a refusal, not silence.
+  const analytics = groups.includes(ANALYTICS_CATEGORY) ? 'granted' : 'denied';
+  const marketing = groups.includes(MARKETING_CATEGORY) ? 'granted' : 'denied';
+  return {
+    analytics,
+    marketing,
+    performance: analytics
+  };
+};
+const createOneTrustConsentProvider = () => ({
+  name: 'onetrust',
+  read: readSnapshot,
+  subscribe(onChange) {
+    const publish = () => onChange(readSnapshot());
+    if (typeof window === 'undefined') {
+      return () => {};
+    }
+    // OneTrust fires this on every banner interaction.
+    window.addEventListener('OneTrustGroupsUpdated', publish);
+    return () => {
+      window.removeEventListener('OneTrustGroupsUpdated', publish);
+    };
+  }
+});
+exports.createOneTrustConsentProvider = createOneTrustConsentProvider;
+//# sourceMappingURL=oneTrustProvider.js.map

package/dist/cjs/privacy/providers/oneTrustProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["ANALYTICS_CATEGORY","MARKETING_CATEGORY","readGroups","window","groups","OnetrustActiveGroups","isOneTrustHost","exports","readSnapshot","console","log","analytics","marketing","performance","includes","createOneTrustConsentProvider","name","read","subscribe","onChange","publish","addEventListener","removeEventListener"],"sources":["../../../../src/privacy/providers/oneTrustProvider.ts"],"sourcesContent":["/**\n * OneTrust provider — DL #218.\n *\n * Lifted from the consent check that used to live inside\n * `utils/analyticsEvents.ts`, with one deliberate behaviour change: that\n * function returned `true` when OneTrust was absent (\"host is responsible for\n * loading OneTrust\"), which on a Shopify storefront meant unconditional\n * default-allow. Absence is no longer this provider's problem — it is only\n * selected when OneTrust is actually on the page, and absence is handled by\n * the gate's own default.\n */\n\nimport type { ConsentProvider, ConsentSnapshot } from '../types';\n\n/** OneTrust's default taxonomy: C0002 is the performance/analytics category. */\nconst ANALYTICS_CATEGORY = 'C0002';\n/** C0004 is targeting/advertising. */\nconst MARKETING_CATEGORY = 'C0004';\n\nconst readGroups = (): string | null => {\n  if (typeof window === 'undefined') {\n    return null;\n  }\n  const groups = (window as unknown as { OnetrustActiveGroups?: unknown })\n    .OnetrustActiveGroups;\n  return typeof groups === 'string' ? groups : null;\n};\n\nexport const isOneTrustHost = (): boolean => readGroups() !== null;\n\nconst readSnapshot = (): ConsentSnapshot => {\n  const groups = readGroups();\n  if (groups !== null) {\n    try {\n      console.log(`[w5-consent] onetrust: active groups \"${groups}\"`);\n    } catch {\n      /* never break on a console */\n    }\n  }\n  if (groups === null) {\n    return { analytics: 'unknown', marketing: 'unknown', performance: 'unknown' };\n  }\n  // OneTrust publishes the *active* groups, so a category that is absent from\n  // a string OneTrust has written is a refusal, not silence.\n  const analytics = groups.includes(ANALYTICS_CATEGORY) ? 'granted' : 'denied';\n  const marketing = groups.includes(MARKETING_CATEGORY) ? 'granted' : 'denied';\n  return { analytics, marketing, performance: analytics };\n};\n\nexport const createOneTrustConsentProvider = (): ConsentProvider => ({\n  name: 'onetrust',\n\n  read: readSnapshot,\n\n  subscribe(onChange) {\n    const publish = () => onChange(readSnapshot());\n    if (typeof window === 'undefined') {\n      return () => {};\n    }\n    // OneTrust fires this on every banner interaction.\n    window.addEventListener('OneTrustGroupsUpdated', publish);\n    return () => {\n      window.removeEventListener('OneTrustGroupsUpdated', publish);\n    };\n  },\n});\n"],"mappings":";;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAIA;AACA,MAAMA,kBAAkB,GAAG,OAAO;AAClC;AACA,MAAMC,kBAAkB,GAAG,OAAO;AAElC,MAAMC,UAAU,GAAGA,CAAA,KAAqB;EACtC,IAAI,OAAOC,MAAM,KAAK,WAAW,EAAE;IACjC,OAAO,IAAI;EACb;EACA,MAAMC,MAAM,GAAID,MAAM,CACnBE,oBAAoB;EACvB,OAAO,OAAOD,MAAM,KAAK,QAAQ,GAAGA,MAAM,GAAG,IAAI;AACnD,CAAC;AAEM,MAAME,cAAc,GAAGA,CAAA,KAAeJ,UAAU,CAAC,CAAC,KAAK,IAAI;AAACK,OAAA,CAAAD,cAAA,GAAAA,cAAA;AAEnE,MAAME,YAAY,GAAGA,CAAA,KAAuB;EAC1C,MAAMJ,MAAM,GAAGF,UAAU,CAAC,CAAC;EAC3B,IAAIE,MAAM,KAAK,IAAI,EAAE;IACnB,IAAI;MACFK,OAAO,CAACC,GAAG,CAAC,yCAAyCN,MAAM,GAAG,CAAC;IACjE,CAAC,CAAC,MAAM;MACN;IAAA;EAEJ;EACA,IAAIA,MAAM,KAAK,IAAI,EAAE;IACnB,OAAO;MAAEO,SAAS,EAAE,SAAS;MAAEC,SAAS,EAAE,SAAS;MAAEC,WAAW,EAAE;IAAU,CAAC;EAC/E;EACA;EACA;EACA,MAAMF,SAAS,GAAGP,MAAM,CAACU,QAAQ,CAACd,kBAAkB,CAAC,GAAG,SAAS,GAAG,QAAQ;EAC5E,MAAMY,SAAS,GAAGR,MAAM,CAACU,QAAQ,CAACb,kBAAkB,CAAC,GAAG,SAAS,GAAG,QAAQ;EAC5E,OAAO;IAAEU,SAAS;IAAEC,SAAS;IAAEC,WAAW,EAAEF;EAAU,CAAC;AACzD,CAAC;AAEM,MAAMI,6BAA6B,GAAGA,CAAA,MAAwB;EACnEC,IAAI,EAAE,UAAU;EAEhBC,IAAI,EAAET,YAAY;EAElBU,SAASA,CAACC,QAAQ,EAAE;IAClB,MAAMC,OAAO,GAAGA,CAAA,KAAMD,QAAQ,CAACX,YAAY,CAAC,CAAC,CAAC;IAC9C,IAAI,OAAOL,MAAM,KAAK,WAAW,EAAE;MACjC,OAAO,MAAM,CAAC,CAAC;IACjB;IACA;IACAA,MAAM,CAACkB,gBAAgB,CAAC,uBAAuB,EAAED,OAAO,CAAC;IACzD,OAAO,MAAM;MACXjB,MAAM,CAACmB,mBAAmB,CAAC,uBAAuB,EAAEF,OAAO,CAAC;IAC9D,CAAC;EACH;AACF,CAAC,CAAC;AAACb,OAAA,CAAAQ,6BAAA,GAAAA,6BAAA","ignoreList":[]}

package/dist/cjs/privacy/providers/shopifyProvider.js

@@ -0,0 +1,177 @@
+"use strict";
+
+exports.__esModule = true;
+exports.isShopifyHost = exports.createShopifyConsentProvider = void 0;
+var _types = require("../types");
+/**
+ * Shopify Customer Privacy API provider — DL #218.
+ *
+ * Two things about this API shape the provider:
+ *
+ * 1. **It is not on the page by default.** `window.Shopify.customerPrivacy` is
+ *    `undefined` until somebody asks for it with `Shopify.loadFeatures`. The
+ *    theme app extension warms it so it is ready before the bundle mounts;
+ *    this provider still requests it, because the extension may not be
+ *    installed and the request is idempotent.
+ *
+ * 2. **`visitorConsentCollected` may have already fired.** The bundle executes
+ *    into an already-rendered storefront page (DL #217), so `read()` answers
+ *    from current state and the event is only ever an update.
+ *
+ * The region rule is the one judgement encoded here, and it keys off
+ * `isRegulationEnforced()` rather than `shouldShowBanner()`. The two are not
+ * interchangeable: the banner reflects what the *merchant* configured, while
+ * enforcement reflects what the *visitor's jurisdiction* requires. A store with
+ * an empty consent configuration reports "no banner needed" everywhere,
+ * including inside the EU.
+ */
+
+const CONSENT_FEATURE = {
+  name: 'consent-tracking-api',
+  version: '0.1'
+};
+const log = (...args) => {
+  try {
+    console.log('[w5-consent] shopify:', ...args);
+  } catch {
+    /* never break on a console */
+  }
+};
+const getShopify = () => {
+  if (typeof window === 'undefined') {
+    return null;
+  }
+  return window.Shopify ?? null;
+};
+const isShopifyHost = () => getShopify() !== null;
+exports.isShopifyHost = isShopifyHost;
+const toState = value => {
+  if (value === 'yes') return 'granted';
+  if (value === 'no') return 'denied';
+  return null;
+};
+const readSnapshot = () => {
+  var _getShopify;
+  const privacy = (_getShopify = getShopify()) == null ? void 0 : _getShopify.customerPrivacy;
+  if (!privacy) {
+    log('customerPrivacy API not on the page — no answer available (store has no privacy configuration, or loadFeatures has not resolved yet)');
+    // The API has not loaded (or the store has no privacy configuration at
+    // all). Not an answer — the gate holds, and the visitor's own action is
+    // what unlocks the session.
+    return _types.UNKNOWN_CONSENT;
+  }
+  let consent = {};
+  try {
+    consent = (privacy.currentVisitorConsent == null ? void 0 : privacy.currentVisitorConsent()) ?? {};
+  } catch {
+    // Present but not ready — treat as no answer yet.
+  }
+  const explicitAnalytics = toState(consent.analytics);
+  const explicitMarketing = toState(consent.marketing);
+  let allowed = false;
+  try {
+    allowed = (privacy.analyticsProcessingAllowed == null ? void 0 : privacy.analyticsProcessingAllowed()) === true;
+  } catch {
+    allowed = false;
+  }
+
+  // Is a privacy regulation in force for *this visitor's* region? This is the
+  // question that matters, and it is not the same question as "is a banner
+  // being shown" — see the comment on `enforced` below.
+  let enforced = null;
+  let regulation = '';
+  let region = '';
+  try {
+    if (typeof privacy.isRegulationEnforced === 'function') {
+      enforced = privacy.isRegulationEnforced() === true;
+    }
+    regulation = (privacy.getRegulation == null ? void 0 : privacy.getRegulation()) ?? '';
+    region = (privacy.getRegion == null ? void 0 : privacy.getRegion()) ?? '';
+  } catch {
+    enforced = null;
+  }
+  let bannerRequired = true;
+  try {
+    bannerRequired = (privacy.shouldShowBanner == null ? void 0 : privacy.shouldShowBanner()) !== false;
+  } catch {
+    bannerRequired = true;
+  }
+
+  /*
+   * Measured on a live store from a Frankfurt IP, with no consent recorded:
+   *
+   *   region 'DEBE' · regulation 'GDPR' · isRegulationEnforced() true
+   *   shouldShowBanner() false · analyticsProcessingAllowed() TRUE
+   *   getShopPrefs() { limit: [] }
+   *
+   * Shopify said tracking was allowed for a GDPR-protected visitor who had
+   * never been asked, because the *merchant* had configured no consent
+   * preferences. `shouldShowBanner()` and `analyticsProcessingAllowed()` both
+   * describe the merchant's setup; neither is a statement about a legal basis.
+   * A merchant's misconfiguration must not become our tracking decision, so
+   * under an enforced regulation an absent answer stays `unknown` and the gate
+   * holds — the visitor's own prompt is then the only thing that unlocks them.
+   */
+  const permissiveDefault = allowed || !bannerRequired;
+  const fallbackWhenUnenforceable = permissiveDefault ? 'granted' : 'unknown';
+  const analytics = explicitAnalytics ?? (enforced === true ? 'unknown' : fallbackWhenUnenforceable);
+  const marketing = explicitMarketing ?? (enforced === true ? 'unknown' : !bannerRequired ? 'granted' : 'unknown');
+  log(`read — visitorConsent.analytics=${consent.analytics ?? '(unset)'} ` + `analyticsProcessingAllowed=${allowed} bannerRequired=${bannerRequired} ` + `region=${region || '?'} regulation=${regulation || '?'} enforced=${enforced === null ? 'unavailable' : enforced}` + (enforced === true && explicitAnalytics === null ? ' → regulated and unanswered, holding' : '') + ` ⇒ ${analytics}`);
+  return {
+    analytics,
+    marketing,
+    // Shopify has no separate performance bucket. Load telemetry carries an
+    // app name and a session id to a Wix endpoint, so it answers to the same
+    // answer analytics does rather than riding for free.
+    performance: analytics
+  };
+};
+
+/**
+ * Ask Shopify to load the consent API if it is not already there. Safe to call
+ * more than once; the callback re-reads whatever state arrives.
+ */
+const requestConsentApi = onReady => {
+  const shopify = getShopify();
+  if (!shopify || shopify.customerPrivacy || !shopify.loadFeatures) {
+    return;
+  }
+  try {
+    log('requesting consent-tracking-api via Shopify.loadFeatures…');
+    shopify.loadFeatures([CONSENT_FEATURE], error => {
+      if (error) {
+        log('loadFeatures failed — gate stays held', error);
+        return;
+      }
+      log('loadFeatures resolved — re-reading consent');
+      onReady();
+    });
+  } catch {
+    // Storefronts without the feature simply never resolve; the gate stays
+    // held and engagement remains the only unlock.
+  }
+};
+const createShopifyConsentProvider = () => ({
+  name: 'shopify-customer-privacy',
+  read: readSnapshot,
+  subscribe(onChange) {
+    const publish = () => {
+      log('visitorConsentCollected — the visitor answered the banner');
+      onChange(readSnapshot());
+    };
+
+    // The visitor may have answered the banner before this bundle existed, so
+    // the event is an update — never the first read.
+    if (typeof document !== 'undefined') {
+      document.addEventListener('visitorConsentCollected', publish);
+    }
+    requestConsentApi(() => onChange(readSnapshot()));
+    return () => {
+      if (typeof document !== 'undefined') {
+        document.removeEventListener('visitorConsentCollected', publish);
+      }
+    };
+  }
+});
+exports.createShopifyConsentProvider = createShopifyConsentProvider;
+//# sourceMappingURL=shopifyProvider.js.map

package/dist/cjs/privacy/providers/shopifyProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_types","require","CONSENT_FEATURE","name","version","log","args","console","getShopify","window","Shopify","isShopifyHost","exports","toState","value","readSnapshot","_getShopify","privacy","customerPrivacy","UNKNOWN_CONSENT","consent","currentVisitorConsent","explicitAnalytics","analytics","explicitMarketing","marketing","allowed","analyticsProcessingAllowed","enforced","regulation","region","isRegulationEnforced","getRegulation","getRegion","bannerRequired","shouldShowBanner","permissiveDefault","fallbackWhenUnenforceable","performance","requestConsentApi","onReady","shopify","loadFeatures","error","createShopifyConsentProvider","read","subscribe","onChange","publish","document","addEventListener","removeEventListener"],"sources":["../../../../src/privacy/providers/shopifyProvider.ts"],"sourcesContent":["/**\n * Shopify Customer Privacy API provider — DL #218.\n *\n * Two things about this API shape the provider:\n *\n * 1. **It is not on the page by default.** `window.Shopify.customerPrivacy` is\n *    `undefined` until somebody asks for it with `Shopify.loadFeatures`. The\n *    theme app extension warms it so it is ready before the bundle mounts;\n *    this provider still requests it, because the extension may not be\n *    installed and the request is idempotent.\n *\n * 2. **`visitorConsentCollected` may have already fired.** The bundle executes\n *    into an already-rendered storefront page (DL #217), so `read()` answers\n *    from current state and the event is only ever an update.\n *\n * The region rule is the one judgement encoded here, and it keys off\n * `isRegulationEnforced()` rather than `shouldShowBanner()`. The two are not\n * interchangeable: the banner reflects what the *merchant* configured, while\n * enforcement reflects what the *visitor's jurisdiction* requires. A store with\n * an empty consent configuration reports \"no banner needed\" everywhere,\n * including inside the EU.\n */\n\nimport {\n  UNKNOWN_CONSENT,\n  type ConsentProvider,\n  type ConsentSnapshot,\n  type ConsentState,\n} from '../types';\n\ntype ShopifyConsentValue = 'yes' | 'no' | '' | undefined;\n\ninterface ShopifyVisitorConsent {\n  analytics?: ShopifyConsentValue;\n  marketing?: ShopifyConsentValue;\n  preferences?: ShopifyConsentValue;\n  sale_of_data?: ShopifyConsentValue;\n}\n\ninterface ShopifyCustomerPrivacy {\n  analyticsProcessingAllowed?: () => boolean;\n  marketingAllowed?: () => boolean;\n  currentVisitorConsent?: () => ShopifyVisitorConsent;\n  shouldShowBanner?: () => boolean;\n  /** Whether a privacy regulation applies to this visitor's region. */\n  isRegulationEnforced?: () => boolean;\n  /** e.g. 'GDPR', 'CCPA'. */\n  getRegulation?: () => string;\n  /** e.g. 'DEBE' — country + subdivision. */\n  getRegion?: () => string;\n}\n\ninterface ShopifyGlobal {\n  customerPrivacy?: ShopifyCustomerPrivacy;\n  loadFeatures?: (\n    features: { name: string; version: string }[],\n    callback: (error?: unknown) => void,\n  ) => void;\n}\n\nconst CONSENT_FEATURE = { name: 'consent-tracking-api', version: '0.1' };\n\nconst log = (...args: unknown[]): void => {\n  try {\n    console.log('[w5-consent] shopify:', ...args);\n  } catch {\n    /* never break on a console */\n  }\n};\n\nconst getShopify = (): ShopifyGlobal | null => {\n  if (typeof window === 'undefined') {\n    return null;\n  }\n  return (window as unknown as { Shopify?: ShopifyGlobal }).Shopify ?? null;\n};\n\nexport const isShopifyHost = (): boolean => getShopify() !== null;\n\nconst toState = (value: ShopifyConsentValue): ConsentState | null => {\n  if (value === 'yes') return 'granted';\n  if (value === 'no') return 'denied';\n  return null;\n};\n\nconst readSnapshot = (): ConsentSnapshot => {\n  const privacy = getShopify()?.customerPrivacy;\n  if (!privacy) {\n    log(\n      'customerPrivacy API not on the page — no answer available (store has no privacy configuration, or loadFeatures has not resolved yet)',\n    );\n    // The API has not loaded (or the store has no privacy configuration at\n    // all). Not an answer — the gate holds, and the visitor's own action is\n    // what unlocks the session.\n    return UNKNOWN_CONSENT;\n  }\n\n  let consent: ShopifyVisitorConsent = {};\n  try {\n    consent = privacy.currentVisitorConsent?.() ?? {};\n  } catch {\n    // Present but not ready — treat as no answer yet.\n  }\n\n  const explicitAnalytics = toState(consent.analytics);\n  const explicitMarketing = toState(consent.marketing);\n\n  let allowed = false;\n  try {\n    allowed = privacy.analyticsProcessingAllowed?.() === true;\n  } catch {\n    allowed = false;\n  }\n\n  // Is a privacy regulation in force for *this visitor's* region? This is the\n  // question that matters, and it is not the same question as \"is a banner\n  // being shown\" — see the comment on `enforced` below.\n  let enforced: boolean | null = null;\n  let regulation = '';\n  let region = '';\n  try {\n    if (typeof privacy.isRegulationEnforced === 'function') {\n      enforced = privacy.isRegulationEnforced() === true;\n    }\n    regulation = privacy.getRegulation?.() ?? '';\n    region = privacy.getRegion?.() ?? '';\n  } catch {\n    enforced = null;\n  }\n\n  let bannerRequired = true;\n  try {\n    bannerRequired = privacy.shouldShowBanner?.() !== false;\n  } catch {\n    bannerRequired = true;\n  }\n\n  /*\n   * Measured on a live store from a Frankfurt IP, with no consent recorded:\n   *\n   *   region 'DEBE' · regulation 'GDPR' · isRegulationEnforced() true\n   *   shouldShowBanner() false · analyticsProcessingAllowed() TRUE\n   *   getShopPrefs() { limit: [] }\n   *\n   * Shopify said tracking was allowed for a GDPR-protected visitor who had\n   * never been asked, because the *merchant* had configured no consent\n   * preferences. `shouldShowBanner()` and `analyticsProcessingAllowed()` both\n   * describe the merchant's setup; neither is a statement about a legal basis.\n   * A merchant's misconfiguration must not become our tracking decision, so\n   * under an enforced regulation an absent answer stays `unknown` and the gate\n   * holds — the visitor's own prompt is then the only thing that unlocks them.\n   */\n  const permissiveDefault = allowed || !bannerRequired;\n  const fallbackWhenUnenforceable = permissiveDefault ? 'granted' : 'unknown';\n\n  const analytics: ConsentState =\n    explicitAnalytics ??\n    (enforced === true ? 'unknown' : fallbackWhenUnenforceable);\n\n  const marketing: ConsentState =\n    explicitMarketing ??\n    (enforced === true ? 'unknown' : !bannerRequired ? 'granted' : 'unknown');\n\n  log(\n    `read — visitorConsent.analytics=${consent.analytics ?? '(unset)'} ` +\n      `analyticsProcessingAllowed=${allowed} bannerRequired=${bannerRequired} ` +\n      `region=${region || '?'} regulation=${regulation || '?'} enforced=${\n        enforced === null ? 'unavailable' : enforced\n      }` +\n      (enforced === true && explicitAnalytics === null\n        ? ' → regulated and unanswered, holding'\n        : '') +\n      ` ⇒ ${analytics}`,\n  );\n\n  return {\n    analytics,\n    marketing,\n    // Shopify has no separate performance bucket. Load telemetry carries an\n    // app name and a session id to a Wix endpoint, so it answers to the same\n    // answer analytics does rather than riding for free.\n    performance: analytics,\n  };\n};\n\n/**\n * Ask Shopify to load the consent API if it is not already there. Safe to call\n * more than once; the callback re-reads whatever state arrives.\n */\nconst requestConsentApi = (onReady: () => void): void => {\n  const shopify = getShopify();\n  if (!shopify || shopify.customerPrivacy || !shopify.loadFeatures) {\n    return;\n  }\n  try {\n    log('requesting consent-tracking-api via Shopify.loadFeatures…');\n    shopify.loadFeatures([CONSENT_FEATURE], (error) => {\n      if (error) {\n        log('loadFeatures failed — gate stays held', error);\n        return;\n      }\n      log('loadFeatures resolved — re-reading consent');\n      onReady();\n    });\n  } catch {\n    // Storefronts without the feature simply never resolve; the gate stays\n    // held and engagement remains the only unlock.\n  }\n};\n\nexport const createShopifyConsentProvider = (): ConsentProvider => ({\n  name: 'shopify-customer-privacy',\n\n  read: readSnapshot,\n\n  subscribe(onChange) {\n    const publish = () => {\n      log('visitorConsentCollected — the visitor answered the banner');\n      onChange(readSnapshot());\n    };\n\n    // The visitor may have answered the banner before this bundle existed, so\n    // the event is an update — never the first read.\n    if (typeof document !== 'undefined') {\n      document.addEventListener('visitorConsentCollected', publish);\n    }\n    requestConsentApi(() => onChange(readSnapshot()));\n\n    return () => {\n      if (typeof document !== 'undefined') {\n        document.removeEventListener('visitorConsentCollected', publish);\n      }\n    };\n  },\n});\n"],"mappings":";;;;AAuBA,IAAAA,MAAA,GAAAC,OAAA;AAvBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAuCA,MAAMC,eAAe,GAAG;EAAEC,IAAI,EAAE,sBAAsB;EAAEC,OAAO,EAAE;AAAM,CAAC;AAExE,MAAMC,GAAG,GAAGA,CAAC,GAAGC,IAAe,KAAW;EACxC,IAAI;IACFC,OAAO,CAACF,GAAG,CAAC,uBAAuB,EAAE,GAAGC,IAAI,CAAC;EAC/C,CAAC,CAAC,MAAM;IACN;EAAA;AAEJ,CAAC;AAED,MAAME,UAAU,GAAGA,CAAA,KAA4B;EAC7C,IAAI,OAAOC,MAAM,KAAK,WAAW,EAAE;IACjC,OAAO,IAAI;EACb;EACA,OAAQA,MAAM,CAA4CC,OAAO,IAAI,IAAI;AAC3E,CAAC;AAEM,MAAMC,aAAa,GAAGA,CAAA,KAAeH,UAAU,CAAC,CAAC,KAAK,IAAI;AAACI,OAAA,CAAAD,aAAA,GAAAA,aAAA;AAElE,MAAME,OAAO,GAAIC,KAA0B,IAA0B;EACnE,IAAIA,KAAK,KAAK,KAAK,EAAE,OAAO,SAAS;EACrC,IAAIA,KAAK,KAAK,IAAI,EAAE,OAAO,QAAQ;EACnC,OAAO,IAAI;AACb,CAAC;AAED,MAAMC,YAAY,GAAGA,CAAA,KAAuB;EAAA,IAAAC,WAAA;EAC1C,MAAMC,OAAO,IAAAD,WAAA,GAAGR,UAAU,CAAC,CAAC,qBAAZQ,WAAA,CAAcE,eAAe;EAC7C,IAAI,CAACD,OAAO,EAAE;IACZZ,GAAG,CACD,sIACF,CAAC;IACD;IACA;IACA;IACA,OAAOc,sBAAe;EACxB;EAEA,IAAIC,OAA8B,GAAG,CAAC,CAAC;EACvC,IAAI;IACFA,OAAO,GAAG,CAAAH,OAAO,CAACI,qBAAqB,oBAA7BJ,OAAO,CAACI,qBAAqB,CAAG,CAAC,KAAI,CAAC,CAAC;EACnD,CAAC,CAAC,MAAM;IACN;EAAA;EAGF,MAAMC,iBAAiB,GAAGT,OAAO,CAACO,OAAO,CAACG,SAAS,CAAC;EACpD,MAAMC,iBAAiB,GAAGX,OAAO,CAACO,OAAO,CAACK,SAAS,CAAC;EAEpD,IAAIC,OAAO,GAAG,KAAK;EACnB,IAAI;IACFA,OAAO,GAAG,CAAAT,OAAO,CAACU,0BAA0B,oBAAlCV,OAAO,CAACU,0BAA0B,CAAG,CAAC,MAAK,IAAI;EAC3D,CAAC,CAAC,MAAM;IACND,OAAO,GAAG,KAAK;EACjB;;EAEA;EACA;EACA;EACA,IAAIE,QAAwB,GAAG,IAAI;EACnC,IAAIC,UAAU,GAAG,EAAE;EACnB,IAAIC,MAAM,GAAG,EAAE;EACf,IAAI;IACF,IAAI,OAAOb,OAAO,CAACc,oBAAoB,KAAK,UAAU,EAAE;MACtDH,QAAQ,GAAGX,OAAO,CAACc,oBAAoB,CAAC,CAAC,KAAK,IAAI;IACpD;IACAF,UAAU,GAAG,CAAAZ,OAAO,CAACe,aAAa,oBAArBf,OAAO,CAACe,aAAa,CAAG,CAAC,KAAI,EAAE;IAC5CF,MAAM,GAAG,CAAAb,OAAO,CAACgB,SAAS,oBAAjBhB,OAAO,CAACgB,SAAS,CAAG,CAAC,KAAI,EAAE;EACtC,CAAC,CAAC,MAAM;IACNL,QAAQ,GAAG,IAAI;EACjB;EAEA,IAAIM,cAAc,GAAG,IAAI;EACzB,IAAI;IACFA,cAAc,GAAG,CAAAjB,OAAO,CAACkB,gBAAgB,oBAAxBlB,OAAO,CAACkB,gBAAgB,CAAG,CAAC,MAAK,KAAK;EACzD,CAAC,CAAC,MAAM;IACND,cAAc,GAAG,IAAI;EACvB;;EAEA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACE,MAAME,iBAAiB,GAAGV,OAAO,IAAI,CAACQ,cAAc;EACpD,MAAMG,yBAAyB,GAAGD,iBAAiB,GAAG,SAAS,GAAG,SAAS;EAE3E,MAAMb,SAAuB,GAC3BD,iBAAiB,KAChBM,QAAQ,KAAK,IAAI,GAAG,SAAS,GAAGS,yBAAyB,CAAC;EAE7D,MAAMZ,SAAuB,GAC3BD,iBAAiB,KAChBI,QAAQ,KAAK,IAAI,GAAG,SAAS,GAAG,CAACM,cAAc,GAAG,SAAS,GAAG,SAAS,CAAC;EAE3E7B,GAAG,CACD,mCAAmCe,OAAO,CAACG,SAAS,IAAI,SAAS,GAAG,GAClE,8BAA8BG,OAAO,mBAAmBQ,cAAc,GAAG,GACzE,UAAUJ,MAAM,IAAI,GAAG,eAAeD,UAAU,IAAI,GAAG,aACrDD,QAAQ,KAAK,IAAI,GAAG,aAAa,GAAGA,QAAQ,EAC5C,IACDA,QAAQ,KAAK,IAAI,IAAIN,iBAAiB,KAAK,IAAI,GAC5C,sCAAsC,GACtC,EAAE,CAAC,GACP,MAAMC,SAAS,EACnB,CAAC;EAED,OAAO;IACLA,SAAS;IACTE,SAAS;IACT;IACA;IACA;IACAa,WAAW,EAAEf;EACf,CAAC;AACH,CAAC;;AAED;AACA;AACA;AACA;AACA,MAAMgB,iBAAiB,GAAIC,OAAmB,IAAW;EACvD,MAAMC,OAAO,GAAGjC,UAAU,CAAC,CAAC;EAC5B,IAAI,CAACiC,OAAO,IAAIA,OAAO,CAACvB,eAAe,IAAI,CAACuB,OAAO,CAACC,YAAY,EAAE;IAChE;EACF;EACA,IAAI;IACFrC,GAAG,CAAC,2DAA2D,CAAC;IAChEoC,OAAO,CAACC,YAAY,CAAC,CAACxC,eAAe,CAAC,EAAGyC,KAAK,IAAK;MACjD,IAAIA,KAAK,EAAE;QACTtC,GAAG,CAAC,uCAAuC,EAAEsC,KAAK,CAAC;QACnD;MACF;MACAtC,GAAG,CAAC,4CAA4C,CAAC;MACjDmC,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;EACJ,CAAC,CAAC,MAAM;IACN;IACA;EAAA;AAEJ,CAAC;AAEM,MAAMI,4BAA4B,GAAGA,CAAA,MAAwB;EAClEzC,IAAI,EAAE,0BAA0B;EAEhC0C,IAAI,EAAE9B,YAAY;EAElB+B,SAASA,CAACC,QAAQ,EAAE;IAClB,MAAMC,OAAO,GAAGA,CAAA,KAAM;MACpB3C,GAAG,CAAC,2DAA2D,CAAC;MAChE0C,QAAQ,CAAChC,YAAY,CAAC,CAAC,CAAC;IAC1B,CAAC;;IAED;IACA;IACA,IAAI,OAAOkC,QAAQ,KAAK,WAAW,EAAE;MACnCA,QAAQ,CAACC,gBAAgB,CAAC,yBAAyB,EAAEF,OAAO,CAAC;IAC/D;IACAT,iBAAiB,CAAC,MAAMQ,QAAQ,CAAChC,YAAY,CAAC,CAAC,CAAC,CAAC;IAEjD,OAAO,MAAM;MACX,IAAI,OAAOkC,QAAQ,KAAK,WAAW,EAAE;QACnCA,QAAQ,CAACE,mBAAmB,CAAC,yBAAyB,EAAEH,OAAO,CAAC;MAClE;IACF,CAAC;EACH;AACF,CAAC,CAAC;AAACpC,OAAA,CAAAgC,4BAAA,GAAAA,4BAAA","ignoreList":[]}

package/dist/cjs/privacy/types.js

@@ -0,0 +1,34 @@
+"use strict";
+
+exports.__esModule = true;
+exports.UNKNOWN_CONSENT = void 0;
+/**
+ * Consent vocabulary shared by the gate and every provider.
+ *
+ * DL #218. Three states, because "we have not been told" is not the same
+ * answer as "no" and must not be collapsed into one: a visitor who has not
+ * been asked can still be unlocked by their own action, a visitor who
+ * refused never can.
+ */
+
+/**
+ * `necessary` is never gated — auth tokens and the configuration fetch are
+ * what make the widget work at all, and a visitor who loaded the page asked
+ * for that much. Everything else answers to the gate.
+ */
+
+const UNKNOWN_CONSENT = exports.UNKNOWN_CONSENT = Object.freeze({
+  performance: 'unknown',
+  analytics: 'unknown',
+  marketing: 'unknown'
+});
+
+/**
+ * A consent provider adapts one host's CMP to the gate.
+ *
+ * `read()` must answer synchronously with what is known *now*. Providers are
+ * installed into an already-rendered storefront page (DL #217), so a provider
+ * that only subscribes is inert — the event it waits for may have fired long
+ * before the bundle executed. Always read first, then subscribe.
+ */
+//# sourceMappingURL=types.js.map

package/dist/cjs/privacy/types.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["UNKNOWN_CONSENT","exports","Object","freeze","performance","analytics","marketing"],"sources":["../../../src/privacy/types.ts"],"sourcesContent":["/**\n * Consent vocabulary shared by the gate and every provider.\n *\n * DL #218. Three states, because \"we have not been told\" is not the same\n * answer as \"no\" and must not be collapsed into one: a visitor who has not\n * been asked can still be unlocked by their own action, a visitor who\n * refused never can.\n */\n\nexport type ConsentState = 'granted' | 'denied' | 'unknown';\n\n/**\n * `necessary` is never gated — auth tokens and the configuration fetch are\n * what make the widget work at all, and a visitor who loaded the page asked\n * for that much. Everything else answers to the gate.\n */\nexport type ConsentPurpose =\n  | 'necessary'\n  | 'performance'\n  | 'analytics'\n  | 'marketing';\n\nexport type GatedPurpose = Exclude<ConsentPurpose, 'necessary'>;\n\nexport type ConsentSnapshot = Record<GatedPurpose, ConsentState>;\n\nexport const UNKNOWN_CONSENT: ConsentSnapshot = Object.freeze({\n  performance: 'unknown',\n  analytics: 'unknown',\n  marketing: 'unknown',\n});\n\n/**\n * A consent provider adapts one host's CMP to the gate.\n *\n * `read()` must answer synchronously with what is known *now*. Providers are\n * installed into an already-rendered storefront page (DL #217), so a provider\n * that only subscribes is inert — the event it waits for may have fired long\n * before the bundle executed. Always read first, then subscribe.\n */\nexport interface ConsentProvider {\n  readonly name: string;\n  read(): ConsentSnapshot;\n  subscribe(onChange: (snapshot: ConsentSnapshot) => void): () => void;\n}\n"],"mappings":";;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAIA;AACA;AACA;AACA;AACA;;AAWO,MAAMA,eAAgC,GAAAC,OAAA,CAAAD,eAAA,GAAGE,MAAM,CAACC,MAAM,CAAC;EAC5DC,WAAW,EAAE,SAAS;EACtBC,SAAS,EAAE,SAAS;EACpBC,SAAS,EAAE;AACb,CAAC,CAAC;;AAEF;AACA;AACA;AACA;AACA;AACA;AACA;AACA","ignoreList":[]}

package/dist/cjs/utils/analyticsEvents.js

@@ -8,18 +8,21 @@ exports.pushEvent = pushEvent;
 exports.pushExit = pushExit;
 exports.pushLinkClick = pushLinkClick;
 exports.pushPromptSubmit = pushPromptSubmit;
-const ANALYTICS_CATEGORY = 'C0002';
+var _consentGate = require("../privacy/consentGate");
+/**
+ * Whether analytics may go on the wire right now.
+ *
+ * DL #218: this used to read OneTrust directly and return `true` when OneTrust
+ * was absent, which on a Shopify storefront — where no host loads OneTrust —
+ * meant unconditional default-allow. It now defers to the consent gate, which
+ * reads whichever CMP the host actually has and, in the absence of any answer,
+ * holds until the visitor does something deliberate.
+ */
 function hasAnalyticsConsent() {
   if (typeof window === 'undefined') {
     return false;
   }
-  const groups = window.OnetrustActiveGroups;
-  if (typeof groups === 'string') {
-    return groups.includes(ANALYTICS_CATEGORY);
-  }
-
-  // No OneTrust on page — allow tracking (host is responsible for loading OneTrust)
-  return true;
+  return (0, _consentGate.mayTransmit)('analytics');
 }
 
 /**
@@ -33,26 +36,28 @@ function pushEvent(eventName, params = {}) {
   if (typeof window === 'undefined') {
     return;
   }
-  if (!hasAnalyticsConsent()) {
-    return;
-  }
 
-  // GTM mode
-  if (window.google_tag_manager && window.dataLayer) {
-    window.dataLayer.push({
-      event: eventName,
-      ...params
-    });
-    return;
-  }
+  // DL #218: routed through the gate rather than checked against it, so an
+  // event raised before consent resolves is held and replayed rather than
+  // dropped on the floor.
+  (0, _consentGate.transmit)('analytics', () => {
+    // GTM mode
+    if (window.google_tag_manager && window.dataLayer) {
+      window.dataLayer.push({
+        event: eventName,
+        ...params
+      });
+      return;
+    }
 
-  // Standalone gtag.js mode
-  if (typeof window.gtag === 'function') {
-    window.gtag('event', eventName, params);
-    return;
-  }
+    // Standalone gtag.js mode
+    if (typeof window.gtag === 'function') {
+      window.gtag('event', eventName, params);
+      return;
+    }
 
-  // No analytics SDK loaded — no-op
+    // No analytics SDK loaded — no-op
+  }, `ga ${eventName}`);
 }
 function pushPromptSubmit(promptType, promptText) {
   pushEvent('web5_prompt_submit', {

package/dist/cjs/utils/analyticsEvents.js.map

@@ -1 +1 @@
-{"version":3,"names":["ANALYTICS_CATEGORY","hasAnalyticsConsent","window","groups","OnetrustActiveGroups","includes","pushEvent","eventName","params","google_tag_manager","dataLayer","push","event","gtag","pushPromptSubmit","promptType","promptText","prompt_type","prompt_text","pushLinkClick","linkUrl","linkType","linkText","link_url","link_type","link_text","pushError","errorType","statusCode","errorMessage","error_type","status_code","error_message","pushExit","exitUrl","exitType","exit_url","exit_type","pushEntityFiltered","reason","entityType","entityId","entity_type","entity_id"],"sources":["../../../src/utils/analyticsEvents.ts"],"sourcesContent":["declare global {\n  interface Window {\n    dataLayer?: Record<string, unknown>[];\n    gtag?: (...args: unknown[]) => void;\n    google_tag_manager?: Record<string, unknown>;\n    OnetrustActiveGroups?: string;\n  }\n}\n\nconst ANALYTICS_CATEGORY = 'C0002';\n\nexport function hasAnalyticsConsent(): boolean {\n  if (typeof window === 'undefined') {\n    return false;\n  }\n\n  const groups = window.OnetrustActiveGroups;\n  if (typeof groups === 'string') {\n    return groups.includes(ANALYTICS_CATEGORY);\n  }\n\n  // No OneTrust on page — allow tracking (host is responsible for loading OneTrust)\n  return true;\n}\n\n/**\n * Universal event dispatch: auto-detects GTM vs standalone gtag.js.\n *\n * GTM is checked first via `google_tag_manager` because when GTM has a GA4\n * tag configured it also creates `window.gtag`. Using dataLayer.push()\n * ensures GTM triggers/tags still process the event.\n */\nexport function pushEvent(\n  eventName: string,\n  params: Record<string, unknown> = {},\n): void {\n  if (typeof window === 'undefined') {\n    return;\n  }\n  if (!hasAnalyticsConsent()) {\n    return;\n  }\n\n  // GTM mode\n  if (window.google_tag_manager && window.dataLayer) {\n    window.dataLayer.push({ event: eventName, ...params });\n    return;\n  }\n\n  // Standalone gtag.js mode\n  if (typeof window.gtag === 'function') {\n    window.gtag('event', eventName, params);\n    return;\n  }\n\n  // No analytics SDK loaded — no-op\n}\n\nexport function pushPromptSubmit(\n  promptType: 'text' | 'chip',\n  promptText: string,\n): void {\n  pushEvent('web5_prompt_submit', {\n    prompt_type: promptType,\n    prompt_text: promptText,\n  });\n}\n\nexport function pushLinkClick(\n  linkUrl: string,\n  linkType: 'web5' | 'external' | 'internal',\n  linkText?: string,\n): void {\n  pushEvent('web5_link_click', {\n    link_url: linkUrl,\n    link_type: linkType,\n    link_text: linkText ?? '',\n  });\n}\n\nexport function pushError(\n  errorType: string,\n  statusCode: number,\n  errorMessage?: string,\n): void {\n  pushEvent('web5_error', {\n    error_type: errorType,\n    status_code: statusCode,\n    error_message: errorMessage ?? '',\n  });\n}\n\nexport function pushExit(\n  exitUrl: string,\n  linkText: string,\n  exitType: 'external' | 'internal',\n): void {\n  pushEvent('web5_exit', {\n    exit_url: exitUrl,\n    link_text: linkText,\n    exit_type: exitType,\n  });\n}\n\nexport type EntityFilteredReason = 'no_data' | 'no_url';\n\nexport function pushEntityFiltered(\n  reason: EntityFilteredReason,\n  entityType: string,\n  entityId: string,\n): void {\n  pushEvent('web5_entity_filtered', {\n    reason,\n    entity_type: entityType,\n    entity_id: entityId,\n  });\n}\n"],"mappings":";;;;;;;;;;AASA,MAAMA,kBAAkB,GAAG,OAAO;AAE3B,SAASC,mBAAmBA,CAAA,EAAY;EAC7C,IAAI,OAAOC,MAAM,KAAK,WAAW,EAAE;IACjC,OAAO,KAAK;EACd;EAEA,MAAMC,MAAM,GAAGD,MAAM,CAACE,oBAAoB;EAC1C,IAAI,OAAOD,MAAM,KAAK,QAAQ,EAAE;IAC9B,OAAOA,MAAM,CAACE,QAAQ,CAACL,kBAAkB,CAAC;EAC5C;;EAEA;EACA,OAAO,IAAI;AACb;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASM,SAASA,CACvBC,SAAiB,EACjBC,MAA+B,GAAG,CAAC,CAAC,EAC9B;EACN,IAAI,OAAON,MAAM,KAAK,WAAW,EAAE;IACjC;EACF;EACA,IAAI,CAACD,mBAAmB,CAAC,CAAC,EAAE;IAC1B;EACF;;EAEA;EACA,IAAIC,MAAM,CAACO,kBAAkB,IAAIP,MAAM,CAACQ,SAAS,EAAE;IACjDR,MAAM,CAACQ,SAAS,CAACC,IAAI,CAAC;MAAEC,KAAK,EAAEL,SAAS;MAAE,GAAGC;IAAO,CAAC,CAAC;IACtD;EACF;;EAEA;EACA,IAAI,OAAON,MAAM,CAACW,IAAI,KAAK,UAAU,EAAE;IACrCX,MAAM,CAACW,IAAI,CAAC,OAAO,EAAEN,SAAS,EAAEC,MAAM,CAAC;IACvC;EACF;;EAEA;AACF;AAEO,SAASM,gBAAgBA,CAC9BC,UAA2B,EAC3BC,UAAkB,EACZ;EACNV,SAAS,CAAC,oBAAoB,EAAE;IAC9BW,WAAW,EAAEF,UAAU;IACvBG,WAAW,EAAEF;EACf,CAAC,CAAC;AACJ;AAEO,SAASG,aAAaA,CAC3BC,OAAe,EACfC,QAA0C,EAC1CC,QAAiB,EACX;EACNhB,SAAS,CAAC,iBAAiB,EAAE;IAC3BiB,QAAQ,EAAEH,OAAO;IACjBI,SAAS,EAAEH,QAAQ;IACnBI,SAAS,EAAEH,QAAQ,IAAI;EACzB,CAAC,CAAC;AACJ;AAEO,SAASI,SAASA,CACvBC,SAAiB,EACjBC,UAAkB,EAClBC,YAAqB,EACf;EACNvB,SAAS,CAAC,YAAY,EAAE;IACtBwB,UAAU,EAAEH,SAAS;IACrBI,WAAW,EAAEH,UAAU;IACvBI,aAAa,EAAEH,YAAY,IAAI;EACjC,CAAC,CAAC;AACJ;AAEO,SAASI,QAAQA,CACtBC,OAAe,EACfZ,QAAgB,EAChBa,QAAiC,EAC3B;EACN7B,SAAS,CAAC,WAAW,EAAE;IACrB8B,QAAQ,EAAEF,OAAO;IACjBT,SAAS,EAAEH,QAAQ;IACnBe,SAAS,EAAEF;EACb,CAAC,CAAC;AACJ;AAIO,SAASG,kBAAkBA,CAChCC,MAA4B,EAC5BC,UAAkB,EAClBC,QAAgB,EACV;EACNnC,SAAS,CAAC,sBAAsB,EAAE;IAChCiC,MAAM;IACNG,WAAW,EAAEF,UAAU;IACvBG,SAAS,EAAEF;EACb,CAAC,CAAC;AACJ","ignoreList":[]}
+{"version":3,"names":["_consentGate","require","hasAnalyticsConsent","window","mayTransmit","pushEvent","eventName","params","transmit","google_tag_manager","dataLayer","push","event","gtag","pushPromptSubmit","promptType","promptText","prompt_type","prompt_text","pushLinkClick","linkUrl","linkType","linkText","link_url","link_type","link_text","pushError","errorType","statusCode","errorMessage","error_type","status_code","error_message","pushExit","exitUrl","exitType","exit_url","exit_type","pushEntityFiltered","reason","entityType","entityId","entity_type","entity_id"],"sources":["../../../src/utils/analyticsEvents.ts"],"sourcesContent":["import { mayTransmit, transmit } from '../privacy/consentGate';\n\ndeclare global {\n  interface Window {\n    dataLayer?: Record<string, unknown>[];\n    gtag?: (...args: unknown[]) => void;\n    google_tag_manager?: Record<string, unknown>;\n    OnetrustActiveGroups?: string;\n  }\n}\n\n/**\n * Whether analytics may go on the wire right now.\n *\n * DL #218: this used to read OneTrust directly and return `true` when OneTrust\n * was absent, which on a Shopify storefront — where no host loads OneTrust —\n * meant unconditional default-allow. It now defers to the consent gate, which\n * reads whichever CMP the host actually has and, in the absence of any answer,\n * holds until the visitor does something deliberate.\n */\nexport function hasAnalyticsConsent(): boolean {\n  if (typeof window === 'undefined') {\n    return false;\n  }\n  return mayTransmit('analytics');\n}\n\n/**\n * Universal event dispatch: auto-detects GTM vs standalone gtag.js.\n *\n * GTM is checked first via `google_tag_manager` because when GTM has a GA4\n * tag configured it also creates `window.gtag`. Using dataLayer.push()\n * ensures GTM triggers/tags still process the event.\n */\nexport function pushEvent(\n  eventName: string,\n  params: Record<string, unknown> = {},\n): void {\n  if (typeof window === 'undefined') {\n    return;\n  }\n\n  // DL #218: routed through the gate rather than checked against it, so an\n  // event raised before consent resolves is held and replayed rather than\n  // dropped on the floor.\n  transmit(\n    'analytics',\n    () => {\n    // GTM mode\n    if (window.google_tag_manager && window.dataLayer) {\n      window.dataLayer.push({ event: eventName, ...params });\n      return;\n    }\n\n    // Standalone gtag.js mode\n    if (typeof window.gtag === 'function') {\n      window.gtag('event', eventName, params);\n      return;\n    }\n\n    // No analytics SDK loaded — no-op\n    },\n    `ga ${eventName}`,\n  );\n}\n\nexport function pushPromptSubmit(\n  promptType: 'text' | 'chip',\n  promptText: string,\n): void {\n  pushEvent('web5_prompt_submit', {\n    prompt_type: promptType,\n    prompt_text: promptText,\n  });\n}\n\nexport function pushLinkClick(\n  linkUrl: string,\n  linkType: 'web5' | 'external' | 'internal',\n  linkText?: string,\n): void {\n  pushEvent('web5_link_click', {\n    link_url: linkUrl,\n    link_type: linkType,\n    link_text: linkText ?? '',\n  });\n}\n\nexport function pushError(\n  errorType: string,\n  statusCode: number,\n  errorMessage?: string,\n): void {\n  pushEvent('web5_error', {\n    error_type: errorType,\n    status_code: statusCode,\n    error_message: errorMessage ?? '',\n  });\n}\n\nexport function pushExit(\n  exitUrl: string,\n  linkText: string,\n  exitType: 'external' | 'internal',\n): void {\n  pushEvent('web5_exit', {\n    exit_url: exitUrl,\n    link_text: linkText,\n    exit_type: exitType,\n  });\n}\n\nexport type EntityFilteredReason = 'no_data' | 'no_url';\n\nexport function pushEntityFiltered(\n  reason: EntityFilteredReason,\n  entityType: string,\n  entityId: string,\n): void {\n  pushEvent('web5_entity_filtered', {\n    reason,\n    entity_type: entityType,\n    entity_id: entityId,\n  });\n}\n"],"mappings":";;;;;;;;;;AAAA,IAAAA,YAAA,GAAAC,OAAA;AAWA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,mBAAmBA,CAAA,EAAY;EAC7C,IAAI,OAAOC,MAAM,KAAK,WAAW,EAAE;IACjC,OAAO,KAAK;EACd;EACA,OAAO,IAAAC,wBAAW,EAAC,WAAW,CAAC;AACjC;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,SAASA,CACvBC,SAAiB,EACjBC,MAA+B,GAAG,CAAC,CAAC,EAC9B;EACN,IAAI,OAAOJ,MAAM,KAAK,WAAW,EAAE;IACjC;EACF;;EAEA;EACA;EACA;EACA,IAAAK,qBAAQ,EACN,WAAW,EACX,MAAM;IACN;IACA,IAAIL,MAAM,CAACM,kBAAkB,IAAIN,MAAM,CAACO,SAAS,EAAE;MACjDP,MAAM,CAACO,SAAS,CAACC,IAAI,CAAC;QAAEC,KAAK,EAAEN,SAAS;QAAE,GAAGC;MAAO,CAAC,CAAC;MACtD;IACF;;IAEA;IACA,IAAI,OAAOJ,MAAM,CAACU,IAAI,KAAK,UAAU,EAAE;MACrCV,MAAM,CAACU,IAAI,CAAC,OAAO,EAAEP,SAAS,EAAEC,MAAM,CAAC;MACvC;IACF;;IAEA;EACA,CAAC,EACD,MAAMD,SAAS,EACjB,CAAC;AACH;AAEO,SAASQ,gBAAgBA,CAC9BC,UAA2B,EAC3BC,UAAkB,EACZ;EACNX,SAAS,CAAC,oBAAoB,EAAE;IAC9BY,WAAW,EAAEF,UAAU;IACvBG,WAAW,EAAEF;EACf,CAAC,CAAC;AACJ;AAEO,SAASG,aAAaA,CAC3BC,OAAe,EACfC,QAA0C,EAC1CC,QAAiB,EACX;EACNjB,SAAS,CAAC,iBAAiB,EAAE;IAC3BkB,QAAQ,EAAEH,OAAO;IACjBI,SAAS,EAAEH,QAAQ;IACnBI,SAAS,EAAEH,QAAQ,IAAI;EACzB,CAAC,CAAC;AACJ;AAEO,SAASI,SAASA,CACvBC,SAAiB,EACjBC,UAAkB,EAClBC,YAAqB,EACf;EACNxB,SAAS,CAAC,YAAY,EAAE;IACtByB,UAAU,EAAEH,SAAS;IACrBI,WAAW,EAAEH,UAAU;IACvBI,aAAa,EAAEH,YAAY,IAAI;EACjC,CAAC,CAAC;AACJ;AAEO,SAASI,QAAQA,CACtBC,OAAe,EACfZ,QAAgB,EAChBa,QAAiC,EAC3B;EACN9B,SAAS,CAAC,WAAW,EAAE;IACrB+B,QAAQ,EAAEF,OAAO;IACjBT,SAAS,EAAEH,QAAQ;IACnBe,SAAS,EAAEF;EACb,CAAC,CAAC;AACJ;AAIO,SAASG,kBAAkBA,CAChCC,MAA4B,EAC5BC,UAAkB,EAClBC,QAAgB,EACV;EACNpC,SAAS,CAAC,sBAAsB,EAAE;IAChCkC,MAAM;IACNG,WAAW,EAAEF,UAAU;IACvBG,SAAS,EAAEF;EACb,CAAC,CAAC;AACJ","ignoreList":[]}

package/dist/esm/component/componentDefinitions/TextBlockSectionDefinition.js

@@ -1,60 +1,67 @@
 import _defineProperty from "@babel/runtime/helpers/defineProperty";
-import { headingMarkdown, bodyText, calloutFromParts } from './parse-utils.js';
+import { headingMarkdown, bodyMarkdown } from './parse-utils.js';
 import { DIAGNOSTIC_TYPES } from '../diagnosticTypes.js';
 export class TextBlockSectionDefinition {
   constructor() {
     _defineProperty(this, "sectionType", 'textBlock');
-    // The trailing callout is OPTIONAL. A heading plus running copy is the shape
-    // stores emit constantly for explainer content, and requiring the blockquote
-    // meant those blocks matched no definition at all and fell through to
-    // `FallbackSectionDefinition` — rendered as undifferentiated prose with no
-    // section treatment. `parse()` already tolerates a missing callout (it only
-    // rejects when title AND description are empty).
+    // A repeated body, not a single `t` — a heading owns ALL the running copy
+    // beneath it. With one `t` the pattern took the heading and the FIRST
+    // paragraph only;
+    // because a pattern matches a PREFIX of the block, every later paragraph fell
+    // through to `FallbackSectionDefinition` and rendered as undifferentiated
+    // prose with no section treatment. Multi-paragraph explainer copy is the
+    // shape stores emit constantly, so most of the block was landing unstyled.
     //
-    // NOTE for registry authors: with the callout optional this also matches a
-    // bare `h2 > t`, and a pattern matches a PREFIX of the block. Register
+    // No callout in the grammar. A trailing blockquote is
+    // `CalloutSectionDefinition`'s (`html_comment? > callout+`) — it sits above
+    // `textBlock` in `createSdkRegistry` and in every client registry, so once
+    // this pattern stops before the quote the parser's next iteration claims it
+    // as its own section. Keeping it here only duplicated that ownership.
+    //
+    // `link` is in the alternation because `convertToBlockElements` unwraps a
+    // paragraph into its inline nodes: `Try narrowing to [men](web5://ask/…)
+    // instead` emits `t link t`. With `t+` alone the run ended at that `link`,
+    // truncating the section at the first paragraph carrying an ask link — the
+    // exact shape DL #134 made the prompts emit. `parse()` uses `bodyMarkdown`,
+    // which keeps the link inline rather than deleting it the way `bodyText`
+    // does. Entity blocks are unaffected: their links are `link[entityType]` and
+    // every registry puts the entity definitions above this one.
+    //
+    // NOTE for registry authors: this still matches a bare `h2 > t`, so the
+    // prefix hazard is unchanged — if anything it claims MORE. Register
     // `textBlock` BELOW every definition whose block opens `h2 > t` — entity,
     // entityCollection, listItemsSection, featureCards, ctaBanner, comparison,
-    // kpi, nextSteps. Above them it claims the heading + intro paragraph off the
+    // kpi, nextSteps. Above them it claims the heading + intro copy off the
     // front of the block and strands the list / links / table that follow
     // (`EntitySectionDefinition` allows `h2 > (t | callout)* > links…`, and
     // `listItemsSection` / `ctaBanner` are the same shape). `createSdkRegistry`
     // and the client registries in this repo order it that way; a client
     // registry living outside this repo has to do the same.
-    _defineProperty(this, "patterns", ['html_comment? > h2 > t > callout?']);
+    _defineProperty(this, "patterns", ['html_comment? > h2 > (t | link)+']);
     _defineProperty(this, "defaults", {
       title: 'Text Block Title',
-      description: 'Description text.',
-      callout: {
-        text: 'A key insight or quote.'
-      }
+      description: 'Description text.'
     });
     _defineProperty(this, "fixtures", [{
       markdown: `## Choosing the Right Liquid Data Option
 
 Liquid Data Go is designed for brands that want affordable, scalable access to syndicated POS, shopper, and pricing insights with minimal setup and no data expertise required.
 
-> If you mainly need fast, packaged insights in one category, Liquid Data Go is usually the right fit; if you need to integrate many datasets and support multiple enterprise workflows, the broader Liquid Data platform and its solutions become more relevant.`,
+It covers a single category out of the box, so a brand can stand up reporting without a data team and without negotiating a full platform contract first.
+
+The broader Liquid Data platform becomes the better fit once you need to integrate many datasets and support multiple enterprise workflows.`,
       expected: {
         title: 'Choosing the Right Liquid Data Option',
-        description: 'Liquid Data Go is designed for brands that want affordable, scalable access to syndicated POS, shopper, and pricing insights with minimal setup and no data expertise required.',
-        callout: {
-          text: 'If you mainly need fast, packaged insights in one category, Liquid Data Go is usually the right fit; if you need to integrate many datasets and support multiple enterprise workflows, the broader Liquid Data platform and its solutions become more relevant.'
-        }
+        description: ['Liquid Data Go is designed for brands that want affordable, scalable access to syndicated POS, shopper, and pricing insights with minimal setup and no data expertise required.', 'It covers a single category out of the box, so a brand can stand up reporting without a data team and without negotiating a full platform contract first.', 'The broader Liquid Data platform becomes the better fit once you need to integrate many datasets and support multiple enterprise workflows.'].join('\n\n')
       }
     }, {
       markdown: `<!-- section: textBlock -->
 ## Key Takeaway
 
-The platform scales with your needs.
-
-> Start small with Go, then expand to the full suite as your data maturity grows.`,
+The platform scales with your needs.`,
       expected: {
         title: 'Key Takeaway',
-        description: 'The platform scales with your needs.',
-        callout: {
-          text: 'Start small with Go, then expand to the full suite as your data maturity grows.'
-        }
+        description: 'The platform scales with your needs.'
       }
     }, {
       markdown: `## How to choose between a clinical serum and a nourishing dry oil
@@ -62,23 +69,20 @@ The platform scales with your needs.
 Clinically tested serums with patented actives target visible reduction of marks and uneven tone, while dry oils focus on broad nourishment and a satin finish.`,
       expected: {
         title: 'How to choose between a clinical serum and a nourishing dry oil',
-        description: 'Clinically tested serums with patented actives target visible reduction of marks and uneven tone, while dry oils focus on broad nourishment and a satin finish.',
-        callout: undefined
+        description: 'Clinically tested serums with patented actives target visible reduction of marks and uneven tone, while dry oils focus on broad nourishment and a satin finish.'
       }
     }]);
   }
   parse(parts, context) {
     const title = headingMarkdown(parts, 2) || '';
-    const description = bodyText(parts) || '';
-    const callout = calloutFromParts(parts);
+    const description = bodyMarkdown(parts) || '';
     if (!title && !description) {
       context == null || context.reportDiagnostic == null || context.reportDiagnostic(DIAGNOSTIC_TYPES.SECTION_REJECTED, 'textBlock: both title and description are empty');
       return null;
     }
     return {
       title,
-      description,
-      callout
+      description
     };
   }
 }

package/dist/esm/component/componentDefinitions/TextBlockSectionDefinition.js.map

@@ -1 +1 @@
-{"version":3,"names":["headingMarkdown","bodyText","calloutFromParts","DIAGNOSTIC_TYPES","TextBlockSectionDefinition","constructor","_defineProperty","title","description","callout","text","markdown","expected","undefined","parse","parts","context","reportDiagnostic","SECTION_REJECTED"],"sources":["../../../../src/component/componentDefinitions/TextBlockSectionDefinition.ts"],"sourcesContent":["import type { Part } from '../../parts/parts';\nimport { headingMarkdown, bodyText, calloutFromParts } from './parse-utils';\nimport type {\n  TextBlockCompProps,\n  TextBlockSectionComponent,\n  SectionFixture,\n} from '../types';\nimport type { SectionDefinition, ParseContext } from '../section-definition';\nimport { DIAGNOSTIC_TYPES } from '../diagnosticTypes';\n\nexport class TextBlockSectionDefinition\n  implements SectionDefinition<TextBlockSectionComponent>\n{\n  sectionType = 'textBlock' as const;\n  // The trailing callout is OPTIONAL. A heading plus running copy is the shape\n  // stores emit constantly for explainer content, and requiring the blockquote\n  // meant those blocks matched no definition at all and fell through to\n  // `FallbackSectionDefinition` — rendered as undifferentiated prose with no\n  // section treatment. `parse()` already tolerates a missing callout (it only\n  // rejects when title AND description are empty).\n  //\n  // NOTE for registry authors: with the callout optional this also matches a\n  // bare `h2 > t`, and a pattern matches a PREFIX of the block. Register\n  // `textBlock` BELOW every definition whose block opens `h2 > t` — entity,\n  // entityCollection, listItemsSection, featureCards, ctaBanner, comparison,\n  // kpi, nextSteps. Above them it claims the heading + intro paragraph off the\n  // front of the block and strands the list / links / table that follow\n  // (`EntitySectionDefinition` allows `h2 > (t | callout)* > links…`, and\n  // `listItemsSection` / `ctaBanner` are the same shape). `createSdkRegistry`\n  // and the client registries in this repo order it that way; a client\n  // registry living outside this repo has to do the same.\n  patterns = ['html_comment? > h2 > t > callout?'];\n\n  defaults: TextBlockCompProps = {\n    title: 'Text Block Title',\n    description: 'Description text.',\n    callout: { text: 'A key insight or quote.' },\n  };\n\n  fixtures: SectionFixture<TextBlockCompProps>[] = [\n    {\n      markdown: `## Choosing the Right Liquid Data Option\n\nLiquid Data Go is designed for brands that want affordable, scalable access to syndicated POS, shopper, and pricing insights with minimal setup and no data expertise required.\n\n> If you mainly need fast, packaged insights in one category, Liquid Data Go is usually the right fit; if you need to integrate many datasets and support multiple enterprise workflows, the broader Liquid Data platform and its solutions become more relevant.`,\n      expected: {\n        title: 'Choosing the Right Liquid Data Option',\n        description:\n          'Liquid Data Go is designed for brands that want affordable, scalable access to syndicated POS, shopper, and pricing insights with minimal setup and no data expertise required.',\n        callout: {\n          text: 'If you mainly need fast, packaged insights in one category, Liquid Data Go is usually the right fit; if you need to integrate many datasets and support multiple enterprise workflows, the broader Liquid Data platform and its solutions become more relevant.',\n        },\n      },\n    },\n    {\n      markdown: `<!-- section: textBlock -->\n## Key Takeaway\n\nThe platform scales with your needs.\n\n> Start small with Go, then expand to the full suite as your data maturity grows.`,\n      expected: {\n        title: 'Key Takeaway',\n        description: 'The platform scales with your needs.',\n        callout: {\n          text: 'Start small with Go, then expand to the full suite as your data maturity grows.',\n        },\n      },\n    },\n    {\n      markdown: `## How to choose between a clinical serum and a nourishing dry oil\n\nClinically tested serums with patented actives target visible reduction of marks and uneven tone, while dry oils focus on broad nourishment and a satin finish.`,\n      expected: {\n        title: 'How to choose between a clinical serum and a nourishing dry oil',\n        description:\n          'Clinically tested serums with patented actives target visible reduction of marks and uneven tone, while dry oils focus on broad nourishment and a satin finish.',\n        callout: undefined,\n      },\n    },\n  ];\n\n  parse(parts: Part[], context?: ParseContext): TextBlockCompProps | null {\n    const title = headingMarkdown(parts, 2) || '';\n    const description = bodyText(parts) || '';\n    const callout = calloutFromParts(parts);\n\n    if (!title && !description) {\n      context?.reportDiagnostic?.(\n        DIAGNOSTIC_TYPES.SECTION_REJECTED,\n        'textBlock: both title and description are empty',\n      );\n      return null;\n    }\n\n    return { title, description, callout };\n  }\n}\n"],"mappings":";AACA,SAASA,eAAe,EAAEC,QAAQ,EAAEC,gBAAgB,QAAQ,eAAe;AAO3E,SAASC,gBAAgB,QAAQ,oBAAoB;AAErD,OAAO,MAAMC,0BAA0B,CAEvC;EAAAC,YAAA;IAAAC,eAAA,sBACgB,WAAW;IACzB;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IAAAA,eAAA,mBACW,CAAC,mCAAmC,CAAC;IAAAA,eAAA,mBAEjB;MAC7BC,KAAK,EAAE,kBAAkB;MACzBC,WAAW,EAAE,mBAAmB;MAChCC,OAAO,EAAE;QAAEC,IAAI,EAAE;MAA0B;IAC7C,CAAC;IAAAJ,eAAA,mBAEgD,CAC/C;MACEK,QAAQ,EAAE;AAChB;AACA;AACA;AACA,kQAAkQ;MAC5PC,QAAQ,EAAE;QACRL,KAAK,EAAE,uCAAuC;QAC9CC,WAAW,EACT,iLAAiL;QACnLC,OAAO,EAAE;UACPC,IAAI,EAAE;QACR;MACF;IACF,CAAC,EACD;MACEC,QAAQ,EAAE;AAChB;AACA;AACA;AACA;AACA,kFAAkF;MAC5EC,QAAQ,EAAE;QACRL,KAAK,EAAE,cAAc;QACrBC,WAAW,EAAE,sCAAsC;QACnDC,OAAO,EAAE;UACPC,IAAI,EAAE;QACR;MACF;IACF,CAAC,EACD;MACEC,QAAQ,EAAE;AAChB;AACA,gKAAgK;MAC1JC,QAAQ,EAAE;QACRL,KAAK,EAAE,iEAAiE;QACxEC,WAAW,EACT,iKAAiK;QACnKC,OAAO,EAAEI;MACX;IACF,CAAC,CACF;EAAA;EAEDC,KAAKA,CAACC,KAAa,EAAEC,OAAsB,EAA6B;IACtE,MAAMT,KAAK,GAAGP,eAAe,CAACe,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE;IAC7C,MAAMP,WAAW,GAAGP,QAAQ,CAACc,KAAK,CAAC,IAAI,EAAE;IACzC,MAAMN,OAAO,GAAGP,gBAAgB,CAACa,KAAK,CAAC;IAEvC,IAAI,CAACR,KAAK,IAAI,CAACC,WAAW,EAAE;MAC1BQ,OAAO,YAAPA,OAAO,CAAEC,gBAAgB,YAAzBD,OAAO,CAAEC,gBAAgB,CACvBd,gBAAgB,CAACe,gBAAgB,EACjC,iDACF,CAAC;MACD,OAAO,IAAI;IACb;IAEA,OAAO;MAAEX,KAAK;MAAEC,WAAW;MAAEC;IAAQ,CAAC;EACxC;AACF","ignoreList":[]}
+{"version":3,"names":["headingMarkdown","bodyMarkdown","DIAGNOSTIC_TYPES","TextBlockSectionDefinition","constructor","_defineProperty","title","description","markdown","expected","join","parse","parts","context","reportDiagnostic","SECTION_REJECTED"],"sources":["../../../../src/component/componentDefinitions/TextBlockSectionDefinition.ts"],"sourcesContent":["import type { Part } from '../../parts/parts';\nimport { headingMarkdown, bodyMarkdown } from './parse-utils';\nimport type {\n  TextBlockCompProps,\n  TextBlockSectionComponent,\n  SectionFixture,\n} from '../types';\nimport type { SectionDefinition, ParseContext } from '../section-definition';\nimport { DIAGNOSTIC_TYPES } from '../diagnosticTypes';\n\nexport class TextBlockSectionDefinition\n  implements SectionDefinition<TextBlockSectionComponent>\n{\n  sectionType = 'textBlock' as const;\n  // A repeated body, not a single `t` — a heading owns ALL the running copy\n  // beneath it. With one `t` the pattern took the heading and the FIRST\n  // paragraph only;\n  // because a pattern matches a PREFIX of the block, every later paragraph fell\n  // through to `FallbackSectionDefinition` and rendered as undifferentiated\n  // prose with no section treatment. Multi-paragraph explainer copy is the\n  // shape stores emit constantly, so most of the block was landing unstyled.\n  //\n  // No callout in the grammar. A trailing blockquote is\n  // `CalloutSectionDefinition`'s (`html_comment? > callout+`) — it sits above\n  // `textBlock` in `createSdkRegistry` and in every client registry, so once\n  // this pattern stops before the quote the parser's next iteration claims it\n  // as its own section. Keeping it here only duplicated that ownership.\n  //\n  // `link` is in the alternation because `convertToBlockElements` unwraps a\n  // paragraph into its inline nodes: `Try narrowing to [men](web5://ask/…)\n  // instead` emits `t link t`. With `t+` alone the run ended at that `link`,\n  // truncating the section at the first paragraph carrying an ask link — the\n  // exact shape DL #134 made the prompts emit. `parse()` uses `bodyMarkdown`,\n  // which keeps the link inline rather than deleting it the way `bodyText`\n  // does. Entity blocks are unaffected: their links are `link[entityType]` and\n  // every registry puts the entity definitions above this one.\n  //\n  // NOTE for registry authors: this still matches a bare `h2 > t`, so the\n  // prefix hazard is unchanged — if anything it claims MORE. Register\n  // `textBlock` BELOW every definition whose block opens `h2 > t` — entity,\n  // entityCollection, listItemsSection, featureCards, ctaBanner, comparison,\n  // kpi, nextSteps. Above them it claims the heading + intro copy off the\n  // front of the block and strands the list / links / table that follow\n  // (`EntitySectionDefinition` allows `h2 > (t | callout)* > links…`, and\n  // `listItemsSection` / `ctaBanner` are the same shape). `createSdkRegistry`\n  // and the client registries in this repo order it that way; a client\n  // registry living outside this repo has to do the same.\n  patterns = ['html_comment? > h2 > (t | link)+'];\n\n  defaults: TextBlockCompProps = {\n    title: 'Text Block Title',\n    description: 'Description text.',\n  };\n\n  fixtures: SectionFixture<TextBlockCompProps>[] = [\n    {\n      markdown: `## Choosing the Right Liquid Data Option\n\nLiquid Data Go is designed for brands that want affordable, scalable access to syndicated POS, shopper, and pricing insights with minimal setup and no data expertise required.\n\nIt covers a single category out of the box, so a brand can stand up reporting without a data team and without negotiating a full platform contract first.\n\nThe broader Liquid Data platform becomes the better fit once you need to integrate many datasets and support multiple enterprise workflows.`,\n      expected: {\n        title: 'Choosing the Right Liquid Data Option',\n        description: [\n          'Liquid Data Go is designed for brands that want affordable, scalable access to syndicated POS, shopper, and pricing insights with minimal setup and no data expertise required.',\n          'It covers a single category out of the box, so a brand can stand up reporting without a data team and without negotiating a full platform contract first.',\n          'The broader Liquid Data platform becomes the better fit once you need to integrate many datasets and support multiple enterprise workflows.',\n        ].join('\\n\\n'),\n      },\n    },\n    {\n      markdown: `<!-- section: textBlock -->\n## Key Takeaway\n\nThe platform scales with your needs.`,\n      expected: {\n        title: 'Key Takeaway',\n        description: 'The platform scales with your needs.',\n      },\n    },\n    {\n      markdown: `## How to choose between a clinical serum and a nourishing dry oil\n\nClinically tested serums with patented actives target visible reduction of marks and uneven tone, while dry oils focus on broad nourishment and a satin finish.`,\n      expected: {\n        title:\n          'How to choose between a clinical serum and a nourishing dry oil',\n        description:\n          'Clinically tested serums with patented actives target visible reduction of marks and uneven tone, while dry oils focus on broad nourishment and a satin finish.',\n      },\n    },\n  ];\n\n  parse(parts: Part[], context?: ParseContext): TextBlockCompProps | null {\n    const title = headingMarkdown(parts, 2) || '';\n    const description = bodyMarkdown(parts) || '';\n\n    if (!title && !description) {\n      context?.reportDiagnostic?.(\n        DIAGNOSTIC_TYPES.SECTION_REJECTED,\n        'textBlock: both title and description are empty',\n      );\n      return null;\n    }\n\n    return { title, description };\n  }\n}\n"],"mappings":";AACA,SAASA,eAAe,EAAEC,YAAY,QAAQ,eAAe;AAO7D,SAASC,gBAAgB,QAAQ,oBAAoB;AAErD,OAAO,MAAMC,0BAA0B,CAEvC;EAAAC,YAAA;IAAAC,eAAA,sBACgB,WAAW;IACzB;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IAAAA,eAAA,mBACW,CAAC,kCAAkC,CAAC;IAAAA,eAAA,mBAEhB;MAC7BC,KAAK,EAAE,kBAAkB;MACzBC,WAAW,EAAE;IACf,CAAC;IAAAF,eAAA,mBAEgD,CAC/C;MACEG,QAAQ,EAAE;AAChB;AACA;AACA;AACA;AACA;AACA,4IAA4I;MACtIC,QAAQ,EAAE;QACRH,KAAK,EAAE,uCAAuC;QAC9CC,WAAW,EAAE,CACX,iLAAiL,EACjL,2JAA2J,EAC3J,6IAA6I,CAC9I,CAACG,IAAI,CAAC,MAAM;MACf;IACF,CAAC,EACD;MACEF,QAAQ,EAAE;AAChB;AACA;AACA,qCAAqC;MAC/BC,QAAQ,EAAE;QACRH,KAAK,EAAE,cAAc;QACrBC,WAAW,EAAE;MACf;IACF,CAAC,EACD;MACEC,QAAQ,EAAE;AAChB;AACA,gKAAgK;MAC1JC,QAAQ,EAAE;QACRH,KAAK,EACH,iEAAiE;QACnEC,WAAW,EACT;MACJ;IACF,CAAC,CACF;EAAA;EAEDI,KAAKA,CAACC,KAAa,EAAEC,OAAsB,EAA6B;IACtE,MAAMP,KAAK,GAAGN,eAAe,CAACY,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE;IAC7C,MAAML,WAAW,GAAGN,YAAY,CAACW,KAAK,CAAC,IAAI,EAAE;IAE7C,IAAI,CAACN,KAAK,IAAI,CAACC,WAAW,EAAE;MAC1BM,OAAO,YAAPA,OAAO,CAAEC,gBAAgB,YAAzBD,OAAO,CAAEC,gBAAgB,CACvBZ,gBAAgB,CAACa,gBAAgB,EACjC,iDACF,CAAC;MACD,OAAO,IAAI;IACb;IAEA,OAAO;MAAET,KAAK;MAAEC;IAAY,CAAC;EAC/B;AACF","ignoreList":[]}

package/dist/esm/component/componentDefinitions/index.js

@@ -55,10 +55,11 @@ export function createSdkRegistry() {
   .register(new CalloutSectionDefinition()).register(new HtmlCommentSectionDefinition()).register(new CtaBannerSectionDefinition())
   // textBlock comes after every definition whose block opens `h2 > t`
   // (entity, listItems, featureCards, ctaBanner, comparison, …). Its
-  // trailing callout is optional, so its pattern also matches a bare
-  // `h2 > t`, and a pattern matches a PREFIX of the block — registered
-  // above those it would claim the heading + intro paragraph and strand
-  // the list / links / table that follow in a separate section.
+  // `h2 > t+` also matches a bare `h2 > t`, and a pattern matches a PREFIX
+  // of the block — registered above those it would claim the heading +
+  // intro copy and strand the list / links / table that follow in a
+  // separate section. It stops before a trailing callout, which Callout
+  // (registered above) then claims on the parser's next iteration.
   .register(new TextBlockSectionDefinition()).register(new FallbackSectionDefinition()).register(new ErrorSectionDefinition());
 }
 //# sourceMappingURL=index.js.map