@wix/web5-core 1.63.44 → 1.63.46

package/dist/cjs/privacy/consentGate.js

@@ -1,93 +1,65 @@
 "use strict";
 
 exports.__esModule = true;
-exports.unlockOnUserAction = exports.transmit = exports.subscribeToConsent = exports.setConsentBufferLimit = exports.resetConsentGateForTests = exports.mayTransmit = exports.mayPersistIdentity = exports.isUserEngaged = exports.installConsentProvider = exports.getInstalledProviderName = exports.getGateView = exports.getConsentSnapshot = exports.getConsentGateStats = void 0;
+exports.unlockOnUserAction = exports.subscribeToConsent = exports.resetConsentGateForTests = exports.mayPersistToken = exports.installConsentProvider = exports.getConsentSnapshot = void 0;
 var _types = require("./types");
 /**
- * The consent gate — DL #218.
+ * The consent gate — DL #218 (revised).
  *
- * Every BI, telemetry and analytics emitter in web5 goes through `transmit()`
- * instead of calling its transport directly. The gate exists because the
- * consent signal resolves *after* the events that need it: Shopify's consent
- * API is not on the page by default and has to be requested, and the fedops
- * app-load pair fires inside that window. A boolean checked at each call site
- * can only ever drop an event that is already in flight; the gate can hold it.
+ * Legal cleared analytics/BI transmission to need no consent gate, so the old
+ * `transmit()` + buffer machinery is gone. What analytics emitters used to route
+ * through the gate now goes straight to the wire.
  *
- * Two independent unlocks, and they do not compose as a plain "either/or":
+ * Analytics AND performance telemetry both go straight to the wire now, so there
+ * is nothing left to "transmit"-gate. What remains is the consent SIGNAL —
+ * snapshot, engagement, provider — behind a single predicate:
  *
- *   | consent   | engaged | result                          |
- *   |-----------|---------|---------------------------------|
- *   | granted   | either  | transmit                        |
- *   | unknown   | no      | hold in the buffer              |
- *   | unknown   | yes     | transmit, and flush what's held |
- *   | denied    | yes     | still nothing                   |
+ *   - `mayPersistToken()` — whether the visitor's OAuth token may be written to
+ *     localStorage. Persisting the token persists a cross-visit visitor identity
+ *     (its refresh token), which is the one thing consent still governs. Truth
+ *     table: granted → yes; denied → never; unknown → only once the visitor
+ *     engaged.
  *
- * Denied outranks engaged. A visitor who refused analytics in the banner does
- * not re-enable tracking by typing a question.
+ * Engagement (`unlockOnUserAction`, fired when the visitor submits a prompt)
+ * resolves the `unknown` case — typing a question is a reason to remember this
+ * visitor for the session — but it never overrides a `denied`.
  */
 
-/** Held events are dropped past this many — a runaway emitter must not become a leak. */
-const DEFAULT_BUFFER_LIMIT = 50;
-
-/**
- * One prefix for the whole consent trail, so `[w5-consent]` in the console
- * filter shows the full story: which CMP was found, what it answered, and for
- * every event whether it was sent, held, dropped or replayed.
- */
 const LOG_PREFIX = '[w5-consent]';
 const log = (...args) => {
   try {
     console.debug(LOG_PREFIX, ...args);
   } catch {
-    // A console that throws must never break a send.
+    // A console that throws must never break anything.
   }
 };
 const describe = s => `analytics=${s.analytics} performance=${s.performance} marketing=${s.marketing}`;
 let snapshot = _types.UNKNOWN_CONSENT;
 let engaged = false;
-let provider = null;
 let unsubscribeProvider = null;
-let buffer = [];
-let bufferLimit = DEFAULT_BUFFER_LIMIT;
-let droppedFromOverflow = 0;
 const listeners = new Set();
-
-/**
- * Cached so `getGateView` is referentially stable between changes —
- * `useSyncExternalStore` re-renders forever if the snapshot is a fresh object
- * on every read.
- */
-let view = Object.freeze({
-  consent: _types.UNKNOWN_CONSENT,
-  engaged: false
-});
-const rebuildView = () => {
-  view = Object.freeze({
-    consent: snapshot,
-    engaged
-  });
-};
 const notify = () => {
   for (const listener of listeners) {
     try {
       listener();
     } catch {
-      // A subscriber that throws must not stop the others, or stop a flush.
+      // A subscriber that throws must not stop the others.
     }
   }
 };
 
 /**
- * Whether an event for `purpose` may go on the wire right now.
+ * Whether the visitor's OAuth token may be persisted to `localStorage`.
  *
- * `necessary` is always allowed. For everything else: explicit consent wins in
- * both directions, and engagement resolves only the `unknown` case.
+ * Persisting the token persists a cross-visit visitor identity (the refresh
+ * token re-identifies the visitor on their next visit), so it answers to
+ * consent — the one thing that still does. Explicit consent wins in both
+ * directions; engagement resolves only the `unknown` case. The token still
+ * lives in memory for the session regardless — only the write to storage is
+ * gated.
  */
-const mayTransmit = purpose => {
-  if (purpose === 'necessary') {
-    return true;
-  }
-  const state = snapshot[purpose];
+const mayPersistToken = () => {
+  const state = snapshot.analytics;
   if (state === 'denied') {
     return false;
   }
@@ -98,116 +70,22 @@ const mayTransmit = purpose => {
 };
 
 /**
- * Release everything the gate is holding that is now allowed, and drop
- * everything that is now refused. Anything still `unknown` stays held.
- *
- * Order is preserved among released events, but a flush necessarily emits them
- * later than they were raised — a held app-load event reaches the wire after
- * the prompt that unlocked it. Anything reading these as a timeline has to
- * know that.
- */
-exports.mayTransmit = mayTransmit;
-const settleBuffer = () => {
-  if (buffer.length === 0) {
-    return;
-  }
-  const stillHeld = [];
-  const releasing = [];
-  for (const held of buffer) {
-    if (mayTransmit(held.purpose)) {
-      releasing.push(held);
-    } else if (snapshot[held.purpose] === 'denied') {
-      // dropped on the floor, deliberately and permanently
-    } else {
-      stillHeld.push(held);
-    }
-  }
-  const dropped = buffer.length - stillHeld.length - releasing.length;
-  buffer = stillHeld;
-  if (releasing.length || dropped) {
-    log(`settle — releasing ${releasing.length}` + (dropped ? `, dropping ${dropped} (refused)` : '') + (stillHeld.length ? `, still holding ${stillHeld.length}` : ''));
-  }
-  for (const held of releasing) {
-    try {
-      log(`  ↳ REPLAY ${held.label} (${held.purpose})`);
-      held.send();
-    } catch {
-      // A failed send must not strand the rest of the flush.
-    }
-  }
-};
-
-/**
- * The single entry point for anything that would put a request on the wire.
- *
- * Allowed → sent now. Refused → dropped. Not yet known → held until an unlock
- * settles it, or discarded with the page.
+ * The visitor did something deliberate — submitted a prompt — so we may remember
+ * them for the session even though no CMP has answered. Unlocks the `unknown`
+ * case only; it cannot override a `denied`.
  */
-const transmit = (purpose, send, label = 'event') => {
-  if (mayTransmit(purpose)) {
-    log(`SEND ${label} (${purpose}) — allowed`);
-    send();
-    return;
-  }
-  if (purpose !== 'necessary' && snapshot[purpose] === 'denied') {
-    log(`DROP ${label} (${purpose}) — visitor refused`);
-    return;
-  }
-  if (buffer.length >= bufferLimit) {
-    droppedFromOverflow += 1;
-    log(`DROP ${label} (${purpose}) — buffer full at ${bufferLimit}, ${droppedFromOverflow} lost`);
-    return;
-  }
-  buffer.push({
-    purpose: purpose,
-    send,
-    label
-  });
-  log(`HOLD ${label} (${purpose}) — no answer yet, ${buffer.length} held`);
-};
-
-/**
- * The visitor did something deliberate — submitted a prompt — so the session
- * may be measured even though no CMP has answered.
- *
- * This is the unlock that keeps web5 measurable at all: on a Shopify store
- * with no privacy configuration the consent API never loads, consent stays
- * `unknown` forever, and without this every store would report nothing.
- *
- * It unlocks **transmission only**. Persistent identity stays gated on real
- * consent (see `mayPersistIdentity`) — typing a question is a reason to
- * measure the session, not a reason to persist an identifier across visits.
- * It also cannot override a `denied`.
- */
-exports.transmit = transmit;
+exports.mayPersistToken = mayPersistToken;
 const unlockOnUserAction = () => {
   if (engaged) {
     return;
   }
   engaged = true;
-  log(`UNLOCK — visitor submitted a prompt; ${buffer.length} held event(s) to settle`);
-  rebuildView();
-  settleBuffer();
+  log('UNLOCK — visitor submitted a prompt');
   notify();
 };
-
-/** Whether the visitor has taken the deliberate action that unlocks the session. */
 exports.unlockOnUserAction = unlockOnUserAction;
-const isUserEngaged = () => engaged;
-
-/**
- * Persistent, cross-visit storage of a visitor identifier requires real
- * consent — engagement is deliberately not enough.
- */
-exports.isUserEngaged = isUserEngaged;
-const mayPersistIdentity = () => snapshot.analytics === 'granted';
-exports.mayPersistIdentity = mayPersistIdentity;
 const getConsentSnapshot = () => snapshot;
-
-/** Referentially stable between changes, for `useSyncExternalStore`. */
 exports.getConsentSnapshot = getConsentSnapshot;
-const getGateView = () => view;
-exports.getGateView = getGateView;
 const subscribeToConsent = listener => {
   listeners.add(listener);
   return () => {
@@ -223,8 +101,6 @@ const applySnapshot = next => {
   snapshot = Object.freeze({
     ...next
   });
-  rebuildView();
-  settleBuffer();
   notify();
 };
 
@@ -236,40 +112,18 @@ const applySnapshot = next => {
  */
 const installConsentProvider = next => {
   unsubscribeProvider == null || unsubscribeProvider();
-  provider = next;
   const initial = next.read();
   log(`provider installed: ${next.name} — reads ${describe(initial)}`);
   applySnapshot(initial);
   unsubscribeProvider = next.subscribe(applySnapshot);
 };
 exports.installConsentProvider = installConsentProvider;
-const getInstalledProviderName = () => {
-  var _provider;
-  return ((_provider = provider) == null ? void 0 : _provider.name) ?? null;
-};
-exports.getInstalledProviderName = getInstalledProviderName;
-const setConsentBufferLimit = limit => {
-  bufferLimit = Math.max(0, limit);
-};
-
-/** Diagnostics only — how much the gate is holding, and what it had to drop. */
-exports.setConsentBufferLimit = setConsentBufferLimit;
-const getConsentGateStats = () => ({
-  held: buffer.length,
-  droppedFromOverflow
-});
-exports.getConsentGateStats = getConsentGateStats;
 const resetConsentGateForTests = () => {
   unsubscribeProvider == null || unsubscribeProvider();
   unsubscribeProvider = null;
-  provider = null;
   snapshot = _types.UNKNOWN_CONSENT;
   engaged = false;
-  buffer = [];
-  bufferLimit = DEFAULT_BUFFER_LIMIT;
-  droppedFromOverflow = 0;
   listeners.clear();
-  rebuildView();
 };
 exports.resetConsentGateForTests = resetConsentGateForTests;
 //# sourceMappingURL=consentGate.js.map

package/dist/cjs/privacy/consentGate.js.map

@@ -1 +1 @@
-{"version":3,"names":["_types","require","DEFAULT_BUFFER_LIMIT","LOG_PREFIX","log","args","console","debug","describe","s","analytics","performance","marketing","snapshot","UNKNOWN_CONSENT","engaged","provider","unsubscribeProvider","buffer","bufferLimit","droppedFromOverflow","listeners","Set","view","Object","freeze","consent","rebuildView","notify","listener","mayTransmit","purpose","state","exports","settleBuffer","length","stillHeld","releasing","held","push","dropped","label","send","transmit","unlockOnUserAction","isUserEngaged","mayPersistIdentity","getConsentSnapshot","getGateView","subscribeToConsent","add","delete","applySnapshot","next","installConsentProvider","initial","read","name","subscribe","getInstalledProviderName","_provider","setConsentBufferLimit","limit","Math","max","getConsentGateStats","resetConsentGateForTests","clear"],"sources":["../../../src/privacy/consentGate.ts"],"sourcesContent":["/**\n * The consent gate — DL #218.\n *\n * Every BI, telemetry and analytics emitter in web5 goes through `transmit()`\n * instead of calling its transport directly. The gate exists because the\n * consent signal resolves *after* the events that need it: Shopify's consent\n * API is not on the page by default and has to be requested, and the fedops\n * app-load pair fires inside that window. A boolean checked at each call site\n * can only ever drop an event that is already in flight; the gate can hold it.\n *\n * Two independent unlocks, and they do not compose as a plain \"either/or\":\n *\n *   | consent   | engaged | result                          |\n *   |-----------|---------|---------------------------------|\n *   | granted   | either  | transmit                        |\n *   | unknown   | no      | hold in the buffer              |\n *   | unknown   | yes     | transmit, and flush what's held |\n *   | denied    | yes     | still nothing                   |\n *\n * Denied outranks engaged. A visitor who refused analytics in the banner does\n * not re-enable tracking by typing a question.\n */\n\nimport {\n  UNKNOWN_CONSENT,\n  type ConsentProvider,\n  type ConsentPurpose,\n  type ConsentSnapshot,\n  type GatedPurpose,\n} from './types';\n\n/** Held events are dropped past this many — a runaway emitter must not become a leak. */\nconst DEFAULT_BUFFER_LIMIT = 50;\n\n/**\n * One prefix for the whole consent trail, so `[w5-consent]` in the console\n * filter shows the full story: which CMP was found, what it answered, and for\n * every event whether it was sent, held, dropped or replayed.\n */\nconst LOG_PREFIX = '[w5-consent]';\n\nconst log = (...args: unknown[]): void => {\n  try {\n    console.debug(LOG_PREFIX, ...args);\n  } catch {\n    // A console that throws must never break a send.\n  }\n};\n\nconst describe = (s: ConsentSnapshot): string =>\n  `analytics=${s.analytics} performance=${s.performance} marketing=${s.marketing}`;\n\ninterface HeldEvent {\n  purpose: GatedPurpose;\n  send: () => void;\n  label: string;\n}\n\nexport interface GateView {\n  consent: ConsentSnapshot;\n  engaged: boolean;\n}\n\ntype Listener = () => void;\n\nlet snapshot: ConsentSnapshot = UNKNOWN_CONSENT;\nlet engaged = false;\nlet provider: ConsentProvider | null = null;\nlet unsubscribeProvider: (() => void) | null = null;\nlet buffer: HeldEvent[] = [];\nlet bufferLimit = DEFAULT_BUFFER_LIMIT;\nlet droppedFromOverflow = 0;\n\nconst listeners = new Set<Listener>();\n\n/**\n * Cached so `getGateView` is referentially stable between changes —\n * `useSyncExternalStore` re-renders forever if the snapshot is a fresh object\n * on every read.\n */\nlet view: GateView = Object.freeze({\n  consent: UNKNOWN_CONSENT,\n  engaged: false,\n});\n\nconst rebuildView = (): void => {\n  view = Object.freeze({ consent: snapshot, engaged });\n};\n\nconst notify = (): void => {\n  for (const listener of listeners) {\n    try {\n      listener();\n    } catch {\n      // A subscriber that throws must not stop the others, or stop a flush.\n    }\n  }\n};\n\n/**\n * Whether an event for `purpose` may go on the wire right now.\n *\n * `necessary` is always allowed. For everything else: explicit consent wins in\n * both directions, and engagement resolves only the `unknown` case.\n */\nexport const mayTransmit = (purpose: ConsentPurpose): boolean => {\n  if (purpose === 'necessary') {\n    return true;\n  }\n  const state = snapshot[purpose];\n  if (state === 'denied') {\n    return false;\n  }\n  if (state === 'granted') {\n    return true;\n  }\n  return engaged;\n};\n\n/**\n * Release everything the gate is holding that is now allowed, and drop\n * everything that is now refused. Anything still `unknown` stays held.\n *\n * Order is preserved among released events, but a flush necessarily emits them\n * later than they were raised — a held app-load event reaches the wire after\n * the prompt that unlocked it. Anything reading these as a timeline has to\n * know that.\n */\nconst settleBuffer = (): void => {\n  if (buffer.length === 0) {\n    return;\n  }\n  const stillHeld: HeldEvent[] = [];\n  const releasing: HeldEvent[] = [];\n\n  for (const held of buffer) {\n    if (mayTransmit(held.purpose)) {\n      releasing.push(held);\n    } else if (snapshot[held.purpose] === 'denied') {\n      // dropped on the floor, deliberately and permanently\n    } else {\n      stillHeld.push(held);\n    }\n  }\n\n  const dropped = buffer.length - stillHeld.length - releasing.length;\n  buffer = stillHeld;\n\n  if (releasing.length || dropped) {\n    log(\n      `settle — releasing ${releasing.length}` +\n        (dropped ? `, dropping ${dropped} (refused)` : '') +\n        (stillHeld.length ? `, still holding ${stillHeld.length}` : ''),\n    );\n  }\n\n  for (const held of releasing) {\n    try {\n      log(`  ↳ REPLAY ${held.label} (${held.purpose})`);\n      held.send();\n    } catch {\n      // A failed send must not strand the rest of the flush.\n    }\n  }\n};\n\n/**\n * The single entry point for anything that would put a request on the wire.\n *\n * Allowed → sent now. Refused → dropped. Not yet known → held until an unlock\n * settles it, or discarded with the page.\n */\nexport const transmit = (\n  purpose: ConsentPurpose,\n  send: () => void,\n  label = 'event',\n): void => {\n  if (mayTransmit(purpose)) {\n    log(`SEND ${label} (${purpose}) — allowed`);\n    send();\n    return;\n  }\n  if (purpose !== 'necessary' && snapshot[purpose] === 'denied') {\n    log(`DROP ${label} (${purpose}) — visitor refused`);\n    return;\n  }\n  if (buffer.length >= bufferLimit) {\n    droppedFromOverflow += 1;\n    log(\n      `DROP ${label} (${purpose}) — buffer full at ${bufferLimit}, ${droppedFromOverflow} lost`,\n    );\n    return;\n  }\n  buffer.push({ purpose: purpose as GatedPurpose, send, label });\n  log(`HOLD ${label} (${purpose}) — no answer yet, ${buffer.length} held`);\n};\n\n/**\n * The visitor did something deliberate — submitted a prompt — so the session\n * may be measured even though no CMP has answered.\n *\n * This is the unlock that keeps web5 measurable at all: on a Shopify store\n * with no privacy configuration the consent API never loads, consent stays\n * `unknown` forever, and without this every store would report nothing.\n *\n * It unlocks **transmission only**. Persistent identity stays gated on real\n * consent (see `mayPersistIdentity`) — typing a question is a reason to\n * measure the session, not a reason to persist an identifier across visits.\n * It also cannot override a `denied`.\n */\nexport const unlockOnUserAction = (): void => {\n  if (engaged) {\n    return;\n  }\n  engaged = true;\n  log(\n    `UNLOCK — visitor submitted a prompt; ${buffer.length} held event(s) to settle`,\n  );\n  rebuildView();\n  settleBuffer();\n  notify();\n};\n\n/** Whether the visitor has taken the deliberate action that unlocks the session. */\nexport const isUserEngaged = (): boolean => engaged;\n\n/**\n * Persistent, cross-visit storage of a visitor identifier requires real\n * consent — engagement is deliberately not enough.\n */\nexport const mayPersistIdentity = (): boolean =>\n  snapshot.analytics === 'granted';\n\nexport const getConsentSnapshot = (): ConsentSnapshot => snapshot;\n\n/** Referentially stable between changes, for `useSyncExternalStore`. */\nexport const getGateView = (): GateView => view;\n\nexport const subscribeToConsent = (listener: Listener): (() => void) => {\n  listeners.add(listener);\n  return () => {\n    listeners.delete(listener);\n  };\n};\n\nconst applySnapshot = (next: ConsentSnapshot): void => {\n  if (\n    next.analytics === snapshot.analytics &&\n    next.marketing === snapshot.marketing &&\n    next.performance === snapshot.performance\n  ) {\n    return;\n  }\n  log(`ANSWER — ${describe(snapshot)}  →  ${describe(next)}`);\n  snapshot = Object.freeze({ ...next });\n  rebuildView();\n  settleBuffer();\n  notify();\n};\n\n/**\n * Install the host's provider. Reads its current state immediately, *then*\n * subscribes — DL #217: a listener registered into an already-rendered page is\n * bound to an event that may have fired long before the bundle executed, so\n * subscribing alone would leave the gate permanently at `unknown`.\n */\nexport const installConsentProvider = (next: ConsentProvider): void => {\n  unsubscribeProvider?.();\n  provider = next;\n  const initial = next.read();\n  log(`provider installed: ${next.name} — reads ${describe(initial)}`);\n  applySnapshot(initial);\n  unsubscribeProvider = next.subscribe(applySnapshot);\n};\n\nexport const getInstalledProviderName = (): string | null =>\n  provider?.name ?? null;\n\nexport const setConsentBufferLimit = (limit: number): void => {\n  bufferLimit = Math.max(0, limit);\n};\n\n/** Diagnostics only — how much the gate is holding, and what it had to drop. */\nexport const getConsentGateStats = (): {\n  held: number;\n  droppedFromOverflow: number;\n} => ({ held: buffer.length, droppedFromOverflow });\n\nexport const resetConsentGateForTests = (): void => {\n  unsubscribeProvider?.();\n  unsubscribeProvider = null;\n  provider = null;\n  snapshot = UNKNOWN_CONSENT;\n  engaged = false;\n  buffer = [];\n  bufferLimit = DEFAULT_BUFFER_LIMIT;\n  droppedFromOverflow = 0;\n  listeners.clear();\n  rebuildView();\n};\n"],"mappings":";;;;AAuBA,IAAAA,MAAA,GAAAC,OAAA;AAvBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAUA;AACA,MAAMC,oBAAoB,GAAG,EAAE;;AAE/B;AACA;AACA;AACA;AACA;AACA,MAAMC,UAAU,GAAG,cAAc;AAEjC,MAAMC,GAAG,GAAGA,CAAC,GAAGC,IAAe,KAAW;EACxC,IAAI;IACFC,OAAO,CAACC,KAAK,CAACJ,UAAU,EAAE,GAAGE,IAAI,CAAC;EACpC,CAAC,CAAC,MAAM;IACN;EAAA;AAEJ,CAAC;AAED,MAAMG,QAAQ,GAAIC,CAAkB,IAClC,aAAaA,CAAC,CAACC,SAAS,gBAAgBD,CAAC,CAACE,WAAW,cAAcF,CAAC,CAACG,SAAS,EAAE;AAelF,IAAIC,QAAyB,GAAGC,sBAAe;AAC/C,IAAIC,OAAO,GAAG,KAAK;AACnB,IAAIC,QAAgC,GAAG,IAAI;AAC3C,IAAIC,mBAAwC,GAAG,IAAI;AACnD,IAAIC,MAAmB,GAAG,EAAE;AAC5B,IAAIC,WAAW,GAAGjB,oBAAoB;AACtC,IAAIkB,mBAAmB,GAAG,CAAC;AAE3B,MAAMC,SAAS,GAAG,IAAIC,GAAG,CAAW,CAAC;;AAErC;AACA;AACA;AACA;AACA;AACA,IAAIC,IAAc,GAAGC,MAAM,CAACC,MAAM,CAAC;EACjCC,OAAO,EAAEZ,sBAAe;EACxBC,OAAO,EAAE;AACX,CAAC,CAAC;AAEF,MAAMY,WAAW,GAAGA,CAAA,KAAY;EAC9BJ,IAAI,GAAGC,MAAM,CAACC,MAAM,CAAC;IAAEC,OAAO,EAAEb,QAAQ;IAAEE;EAAQ,CAAC,CAAC;AACtD,CAAC;AAED,MAAMa,MAAM,GAAGA,CAAA,KAAY;EACzB,KAAK,MAAMC,QAAQ,IAAIR,SAAS,EAAE;IAChC,IAAI;MACFQ,QAAQ,CAAC,CAAC;IACZ,CAAC,CAAC,MAAM;MACN;IAAA;EAEJ;AACF,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACO,MAAMC,WAAW,GAAIC,OAAuB,IAAc;EAC/D,IAAIA,OAAO,KAAK,WAAW,EAAE;IAC3B,OAAO,IAAI;EACb;EACA,MAAMC,KAAK,GAAGnB,QAAQ,CAACkB,OAAO,CAAC;EAC/B,IAAIC,KAAK,KAAK,QAAQ,EAAE;IACtB,OAAO,KAAK;EACd;EACA,IAAIA,KAAK,KAAK,SAAS,EAAE;IACvB,OAAO,IAAI;EACb;EACA,OAAOjB,OAAO;AAChB,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AARAkB,OAAA,CAAAH,WAAA,GAAAA,WAAA;AASA,MAAMI,YAAY,GAAGA,CAAA,KAAY;EAC/B,IAAIhB,MAAM,CAACiB,MAAM,KAAK,CAAC,EAAE;IACvB;EACF;EACA,MAAMC,SAAsB,GAAG,EAAE;EACjC,MAAMC,SAAsB,GAAG,EAAE;EAEjC,KAAK,MAAMC,IAAI,IAAIpB,MAAM,EAAE;IACzB,IAAIY,WAAW,CAACQ,IAAI,CAACP,OAAO,CAAC,EAAE;MAC7BM,SAAS,CAACE,IAAI,CAACD,IAAI,CAAC;IACtB,CAAC,MAAM,IAAIzB,QAAQ,CAACyB,IAAI,CAACP,OAAO,CAAC,KAAK,QAAQ,EAAE;MAC9C;IAAA,CACD,MAAM;MACLK,SAAS,CAACG,IAAI,CAACD,IAAI,CAAC;IACtB;EACF;EAEA,MAAME,OAAO,GAAGtB,MAAM,CAACiB,MAAM,GAAGC,SAAS,CAACD,MAAM,GAAGE,SAAS,CAACF,MAAM;EACnEjB,MAAM,GAAGkB,SAAS;EAElB,IAAIC,SAAS,CAACF,MAAM,IAAIK,OAAO,EAAE;IAC/BpC,GAAG,CACD,sBAAsBiC,SAAS,CAACF,MAAM,EAAE,IACrCK,OAAO,GAAG,cAAcA,OAAO,YAAY,GAAG,EAAE,CAAC,IACjDJ,SAAS,CAACD,MAAM,GAAG,mBAAmBC,SAAS,CAACD,MAAM,EAAE,GAAG,EAAE,CAClE,CAAC;EACH;EAEA,KAAK,MAAMG,IAAI,IAAID,SAAS,EAAE;IAC5B,IAAI;MACFjC,GAAG,CAAC,cAAckC,IAAI,CAACG,KAAK,KAAKH,IAAI,CAACP,OAAO,GAAG,CAAC;MACjDO,IAAI,CAACI,IAAI,CAAC,CAAC;IACb,CAAC,CAAC,MAAM;MACN;IAAA;EAEJ;AACF,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACO,MAAMC,QAAQ,GAAGA,CACtBZ,OAAuB,EACvBW,IAAgB,EAChBD,KAAK,GAAG,OAAO,KACN;EACT,IAAIX,WAAW,CAACC,OAAO,CAAC,EAAE;IACxB3B,GAAG,CAAC,QAAQqC,KAAK,KAAKV,OAAO,aAAa,CAAC;IAC3CW,IAAI,CAAC,CAAC;IACN;EACF;EACA,IAAIX,OAAO,KAAK,WAAW,IAAIlB,QAAQ,CAACkB,OAAO,CAAC,KAAK,QAAQ,EAAE;IAC7D3B,GAAG,CAAC,QAAQqC,KAAK,KAAKV,OAAO,qBAAqB,CAAC;IACnD;EACF;EACA,IAAIb,MAAM,CAACiB,MAAM,IAAIhB,WAAW,EAAE;IAChCC,mBAAmB,IAAI,CAAC;IACxBhB,GAAG,CACD,QAAQqC,KAAK,KAAKV,OAAO,sBAAsBZ,WAAW,KAAKC,mBAAmB,OACpF,CAAC;IACD;EACF;EACAF,MAAM,CAACqB,IAAI,CAAC;IAAER,OAAO,EAAEA,OAAuB;IAAEW,IAAI;IAAED;EAAM,CAAC,CAAC;EAC9DrC,GAAG,CAAC,QAAQqC,KAAK,KAAKV,OAAO,sBAAsBb,MAAM,CAACiB,MAAM,OAAO,CAAC;AAC1E,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAZAF,OAAA,CAAAU,QAAA,GAAAA,QAAA;AAaO,MAAMC,kBAAkB,GAAGA,CAAA,KAAY;EAC5C,IAAI7B,OAAO,EAAE;IACX;EACF;EACAA,OAAO,GAAG,IAAI;EACdX,GAAG,CACD,wCAAwCc,MAAM,CAACiB,MAAM,0BACvD,CAAC;EACDR,WAAW,CAAC,CAAC;EACbO,YAAY,CAAC,CAAC;EACdN,MAAM,CAAC,CAAC;AACV,CAAC;;AAED;AAAAK,OAAA,CAAAW,kBAAA,GAAAA,kBAAA;AACO,MAAMC,aAAa,GAAGA,CAAA,KAAe9B,OAAO;;AAEnD;AACA;AACA;AACA;AAHAkB,OAAA,CAAAY,aAAA,GAAAA,aAAA;AAIO,MAAMC,kBAAkB,GAAGA,CAAA,KAChCjC,QAAQ,CAACH,SAAS,KAAK,SAAS;AAACuB,OAAA,CAAAa,kBAAA,GAAAA,kBAAA;AAE5B,MAAMC,kBAAkB,GAAGA,CAAA,KAAuBlC,QAAQ;;AAEjE;AAAAoB,OAAA,CAAAc,kBAAA,GAAAA,kBAAA;AACO,MAAMC,WAAW,GAAGA,CAAA,KAAgBzB,IAAI;AAACU,OAAA,CAAAe,WAAA,GAAAA,WAAA;AAEzC,MAAMC,kBAAkB,GAAIpB,QAAkB,IAAmB;EACtER,SAAS,CAAC6B,GAAG,CAACrB,QAAQ,CAAC;EACvB,OAAO,MAAM;IACXR,SAAS,CAAC8B,MAAM,CAACtB,QAAQ,CAAC;EAC5B,CAAC;AACH,CAAC;AAACI,OAAA,CAAAgB,kBAAA,GAAAA,kBAAA;AAEF,MAAMG,aAAa,GAAIC,IAAqB,IAAW;EACrD,IACEA,IAAI,CAAC3C,SAAS,KAAKG,QAAQ,CAACH,SAAS,IACrC2C,IAAI,CAACzC,SAAS,KAAKC,QAAQ,CAACD,SAAS,IACrCyC,IAAI,CAAC1C,WAAW,KAAKE,QAAQ,CAACF,WAAW,EACzC;IACA;EACF;EACAP,GAAG,CAAC,YAAYI,QAAQ,CAACK,QAAQ,CAAC,QAAQL,QAAQ,CAAC6C,IAAI,CAAC,EAAE,CAAC;EAC3DxC,QAAQ,GAAGW,MAAM,CAACC,MAAM,CAAC;IAAE,GAAG4B;EAAK,CAAC,CAAC;EACrC1B,WAAW,CAAC,CAAC;EACbO,YAAY,CAAC,CAAC;EACdN,MAAM,CAAC,CAAC;AACV,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACO,MAAM0B,sBAAsB,GAAID,IAAqB,IAAW;EACrEpC,mBAAmB,YAAnBA,mBAAmB,CAAG,CAAC;EACvBD,QAAQ,GAAGqC,IAAI;EACf,MAAME,OAAO,GAAGF,IAAI,CAACG,IAAI,CAAC,CAAC;EAC3BpD,GAAG,CAAC,uBAAuBiD,IAAI,CAACI,IAAI,YAAYjD,QAAQ,CAAC+C,OAAO,CAAC,EAAE,CAAC;EACpEH,aAAa,CAACG,OAAO,CAAC;EACtBtC,mBAAmB,GAAGoC,IAAI,CAACK,SAAS,CAACN,aAAa,CAAC;AACrD,CAAC;AAACnB,OAAA,CAAAqB,sBAAA,GAAAA,sBAAA;AAEK,MAAMK,wBAAwB,GAAGA,CAAA;EAAA,IAAAC,SAAA;EAAA,OACtC,EAAAA,SAAA,GAAA5C,QAAQ,qBAAR4C,SAAA,CAAUH,IAAI,KAAI,IAAI;AAAA;AAACxB,OAAA,CAAA0B,wBAAA,GAAAA,wBAAA;AAElB,MAAME,qBAAqB,GAAIC,KAAa,IAAW;EAC5D3C,WAAW,GAAG4C,IAAI,CAACC,GAAG,CAAC,CAAC,EAAEF,KAAK,CAAC;AAClC,CAAC;;AAED;AAAA7B,OAAA,CAAA4B,qBAAA,GAAAA,qBAAA;AACO,MAAMI,mBAAmB,GAAGA,CAAA,MAG7B;EAAE3B,IAAI,EAAEpB,MAAM,CAACiB,MAAM;EAAEf;AAAoB,CAAC,CAAC;AAACa,OAAA,CAAAgC,mBAAA,GAAAA,mBAAA;AAE7C,MAAMC,wBAAwB,GAAGA,CAAA,KAAY;EAClDjD,mBAAmB,YAAnBA,mBAAmB,CAAG,CAAC;EACvBA,mBAAmB,GAAG,IAAI;EAC1BD,QAAQ,GAAG,IAAI;EACfH,QAAQ,GAAGC,sBAAe;EAC1BC,OAAO,GAAG,KAAK;EACfG,MAAM,GAAG,EAAE;EACXC,WAAW,GAAGjB,oBAAoB;EAClCkB,mBAAmB,GAAG,CAAC;EACvBC,SAAS,CAAC8C,KAAK,CAAC,CAAC;EACjBxC,WAAW,CAAC,CAAC;AACf,CAAC;AAACM,OAAA,CAAAiC,wBAAA,GAAAA,wBAAA","ignoreList":[]}
+{"version":3,"names":["_types","require","LOG_PREFIX","log","args","console","debug","describe","s","analytics","performance","marketing","snapshot","UNKNOWN_CONSENT","engaged","unsubscribeProvider","listeners","Set","notify","listener","mayPersistToken","state","exports","unlockOnUserAction","getConsentSnapshot","subscribeToConsent","add","delete","applySnapshot","next","Object","freeze","installConsentProvider","initial","read","name","subscribe","resetConsentGateForTests","clear"],"sources":["../../../src/privacy/consentGate.ts"],"sourcesContent":["/**\n * The consent gate — DL #218 (revised).\n *\n * Legal cleared analytics/BI transmission to need no consent gate, so the old\n * `transmit()` + buffer machinery is gone. What analytics emitters used to route\n * through the gate now goes straight to the wire.\n *\n * Analytics AND performance telemetry both go straight to the wire now, so there\n * is nothing left to \"transmit\"-gate. What remains is the consent SIGNAL —\n * snapshot, engagement, provider — behind a single predicate:\n *\n *   - `mayPersistToken()` — whether the visitor's OAuth token may be written to\n *     localStorage. Persisting the token persists a cross-visit visitor identity\n *     (its refresh token), which is the one thing consent still governs. Truth\n *     table: granted → yes; denied → never; unknown → only once the visitor\n *     engaged.\n *\n * Engagement (`unlockOnUserAction`, fired when the visitor submits a prompt)\n * resolves the `unknown` case — typing a question is a reason to remember this\n * visitor for the session — but it never overrides a `denied`.\n */\n\nimport {\n  UNKNOWN_CONSENT,\n  type ConsentProvider,\n  type ConsentSnapshot,\n} from './types';\n\nconst LOG_PREFIX = '[w5-consent]';\n\nconst log = (...args: unknown[]): void => {\n  try {\n    console.debug(LOG_PREFIX, ...args);\n  } catch {\n    // A console that throws must never break anything.\n  }\n};\n\nconst describe = (s: ConsentSnapshot): string =>\n  `analytics=${s.analytics} performance=${s.performance} marketing=${s.marketing}`;\n\ntype Listener = () => void;\n\nlet snapshot: ConsentSnapshot = UNKNOWN_CONSENT;\nlet engaged = false;\nlet unsubscribeProvider: (() => void) | null = null;\n\nconst listeners = new Set<Listener>();\n\nconst notify = (): void => {\n  for (const listener of listeners) {\n    try {\n      listener();\n    } catch {\n      // A subscriber that throws must not stop the others.\n    }\n  }\n};\n\n/**\n * Whether the visitor's OAuth token may be persisted to `localStorage`.\n *\n * Persisting the token persists a cross-visit visitor identity (the refresh\n * token re-identifies the visitor on their next visit), so it answers to\n * consent — the one thing that still does. Explicit consent wins in both\n * directions; engagement resolves only the `unknown` case. The token still\n * lives in memory for the session regardless — only the write to storage is\n * gated.\n */\nexport const mayPersistToken = (): boolean => {\n  const state = snapshot.analytics;\n  if (state === 'denied') {\n    return false;\n  }\n  if (state === 'granted') {\n    return true;\n  }\n  return engaged;\n};\n\n/**\n * The visitor did something deliberate — submitted a prompt — so we may remember\n * them for the session even though no CMP has answered. Unlocks the `unknown`\n * case only; it cannot override a `denied`.\n */\nexport const unlockOnUserAction = (): void => {\n  if (engaged) {\n    return;\n  }\n  engaged = true;\n  log('UNLOCK — visitor submitted a prompt');\n  notify();\n};\n\nexport const getConsentSnapshot = (): ConsentSnapshot => snapshot;\n\nexport const subscribeToConsent = (listener: Listener): (() => void) => {\n  listeners.add(listener);\n  return () => {\n    listeners.delete(listener);\n  };\n};\n\nconst applySnapshot = (next: ConsentSnapshot): void => {\n  if (\n    next.analytics === snapshot.analytics &&\n    next.marketing === snapshot.marketing &&\n    next.performance === snapshot.performance\n  ) {\n    return;\n  }\n  log(`ANSWER — ${describe(snapshot)}  →  ${describe(next)}`);\n  snapshot = Object.freeze({ ...next });\n  notify();\n};\n\n/**\n * Install the host's provider. Reads its current state immediately, *then*\n * subscribes — DL #217: a listener registered into an already-rendered page is\n * bound to an event that may have fired long before the bundle executed, so\n * subscribing alone would leave the gate permanently at `unknown`.\n */\nexport const installConsentProvider = (next: ConsentProvider): void => {\n  unsubscribeProvider?.();\n  const initial = next.read();\n  log(`provider installed: ${next.name} — reads ${describe(initial)}`);\n  applySnapshot(initial);\n  unsubscribeProvider = next.subscribe(applySnapshot);\n};\n\nexport const resetConsentGateForTests = (): void => {\n  unsubscribeProvider?.();\n  unsubscribeProvider = null;\n  snapshot = UNKNOWN_CONSENT;\n  engaged = false;\n  listeners.clear();\n};\n"],"mappings":";;;;AAsBA,IAAAA,MAAA,GAAAC,OAAA;AAtBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAQA,MAAMC,UAAU,GAAG,cAAc;AAEjC,MAAMC,GAAG,GAAGA,CAAC,GAAGC,IAAe,KAAW;EACxC,IAAI;IACFC,OAAO,CAACC,KAAK,CAACJ,UAAU,EAAE,GAAGE,IAAI,CAAC;EACpC,CAAC,CAAC,MAAM;IACN;EAAA;AAEJ,CAAC;AAED,MAAMG,QAAQ,GAAIC,CAAkB,IAClC,aAAaA,CAAC,CAACC,SAAS,gBAAgBD,CAAC,CAACE,WAAW,cAAcF,CAAC,CAACG,SAAS,EAAE;AAIlF,IAAIC,QAAyB,GAAGC,sBAAe;AAC/C,IAAIC,OAAO,GAAG,KAAK;AACnB,IAAIC,mBAAwC,GAAG,IAAI;AAEnD,MAAMC,SAAS,GAAG,IAAIC,GAAG,CAAW,CAAC;AAErC,MAAMC,MAAM,GAAGA,CAAA,KAAY;EACzB,KAAK,MAAMC,QAAQ,IAAIH,SAAS,EAAE;IAChC,IAAI;MACFG,QAAQ,CAAC,CAAC;IACZ,CAAC,CAAC,MAAM;MACN;IAAA;EAEJ;AACF,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMC,eAAe,GAAGA,CAAA,KAAe;EAC5C,MAAMC,KAAK,GAAGT,QAAQ,CAACH,SAAS;EAChC,IAAIY,KAAK,KAAK,QAAQ,EAAE;IACtB,OAAO,KAAK;EACd;EACA,IAAIA,KAAK,KAAK,SAAS,EAAE;IACvB,OAAO,IAAI;EACb;EACA,OAAOP,OAAO;AAChB,CAAC;;AAED;AACA;AACA;AACA;AACA;AAJAQ,OAAA,CAAAF,eAAA,GAAAA,eAAA;AAKO,MAAMG,kBAAkB,GAAGA,CAAA,KAAY;EAC5C,IAAIT,OAAO,EAAE;IACX;EACF;EACAA,OAAO,GAAG,IAAI;EACdX,GAAG,CAAC,qCAAqC,CAAC;EAC1Ce,MAAM,CAAC,CAAC;AACV,CAAC;AAACI,OAAA,CAAAC,kBAAA,GAAAA,kBAAA;AAEK,MAAMC,kBAAkB,GAAGA,CAAA,KAAuBZ,QAAQ;AAACU,OAAA,CAAAE,kBAAA,GAAAA,kBAAA;AAE3D,MAAMC,kBAAkB,GAAIN,QAAkB,IAAmB;EACtEH,SAAS,CAACU,GAAG,CAACP,QAAQ,CAAC;EACvB,OAAO,MAAM;IACXH,SAAS,CAACW,MAAM,CAACR,QAAQ,CAAC;EAC5B,CAAC;AACH,CAAC;AAACG,OAAA,CAAAG,kBAAA,GAAAA,kBAAA;AAEF,MAAMG,aAAa,GAAIC,IAAqB,IAAW;EACrD,IACEA,IAAI,CAACpB,SAAS,KAAKG,QAAQ,CAACH,SAAS,IACrCoB,IAAI,CAAClB,SAAS,KAAKC,QAAQ,CAACD,SAAS,IACrCkB,IAAI,CAACnB,WAAW,KAAKE,QAAQ,CAACF,WAAW,EACzC;IACA;EACF;EACAP,GAAG,CAAC,YAAYI,QAAQ,CAACK,QAAQ,CAAC,QAAQL,QAAQ,CAACsB,IAAI,CAAC,EAAE,CAAC;EAC3DjB,QAAQ,GAAGkB,MAAM,CAACC,MAAM,CAAC;IAAE,GAAGF;EAAK,CAAC,CAAC;EACrCX,MAAM,CAAC,CAAC;AACV,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACO,MAAMc,sBAAsB,GAAIH,IAAqB,IAAW;EACrEd,mBAAmB,YAAnBA,mBAAmB,CAAG,CAAC;EACvB,MAAMkB,OAAO,GAAGJ,IAAI,CAACK,IAAI,CAAC,CAAC;EAC3B/B,GAAG,CAAC,uBAAuB0B,IAAI,CAACM,IAAI,YAAY5B,QAAQ,CAAC0B,OAAO,CAAC,EAAE,CAAC;EACpEL,aAAa,CAACK,OAAO,CAAC;EACtBlB,mBAAmB,GAAGc,IAAI,CAACO,SAAS,CAACR,aAAa,CAAC;AACrD,CAAC;AAACN,OAAA,CAAAU,sBAAA,GAAAA,sBAAA;AAEK,MAAMK,wBAAwB,GAAGA,CAAA,KAAY;EAClDtB,mBAAmB,YAAnBA,mBAAmB,CAAG,CAAC;EACvBA,mBAAmB,GAAG,IAAI;EAC1BH,QAAQ,GAAGC,sBAAe;EAC1BC,OAAO,GAAG,KAAK;EACfE,SAAS,CAACsB,KAAK,CAAC,CAAC;AACnB,CAAC;AAAChB,OAAA,CAAAe,wBAAA,GAAAA,wBAAA","ignoreList":[]}

package/dist/cjs/privacy/index.js

@@ -1,22 +1,15 @@
 "use strict";
 
 exports.__esModule = true;
-exports.unlockOnUserAction = exports.transmit = exports.subscribeToConsent = exports.setConsentOverride = exports.setConsentBufferLimit = exports.resetConsentGateForTests = exports.publishHostConsent = exports.mayTransmit = exports.mayPersistIdentity = exports.isUserEngaged = exports.isShopifyHost = exports.isOneTrustHost = exports.installConsentProvider = exports.initConsentGate = exports.hasHostSuppliedConsent = exports.getInstalledProviderName = exports.getGateView = exports.getConsentSnapshot = exports.getConsentOverride = exports.getConsentGateStats = exports.detectConsentProvider = exports.createShopifyConsentProvider = exports.createOneTrustConsentProvider = exports.createHostSuppliedConsentProvider = exports.UNKNOWN_CONSENT = exports.HOST_CONSENT_GLOBAL = exports.CONSENT_OVERRIDE_QUERY_PARAM = exports.CONSENT_OVERRIDE_KEY = void 0;
+exports.unlockOnUserAction = exports.subscribeToConsent = exports.setConsentOverride = exports.resetConsentGateForTests = exports.publishHostConsent = exports.mayPersistToken = exports.isShopifyHost = exports.isOneTrustHost = exports.installConsentProvider = exports.initConsentGate = exports.hasHostSuppliedConsent = exports.getConsentSnapshot = exports.getConsentOverride = exports.detectConsentProvider = exports.createShopifyConsentProvider = exports.createOneTrustConsentProvider = exports.createHostSuppliedConsentProvider = exports.UNKNOWN_CONSENT = exports.HOST_CONSENT_GLOBAL = exports.CONSENT_OVERRIDE_QUERY_PARAM = exports.CONSENT_OVERRIDE_KEY = void 0;
 var _types = require("./types");
 exports.UNKNOWN_CONSENT = _types.UNKNOWN_CONSENT;
 var _consentGate = require("./consentGate");
-exports.transmit = _consentGate.transmit;
-exports.mayTransmit = _consentGate.mayTransmit;
 exports.unlockOnUserAction = _consentGate.unlockOnUserAction;
-exports.isUserEngaged = _consentGate.isUserEngaged;
-exports.mayPersistIdentity = _consentGate.mayPersistIdentity;
+exports.mayPersistToken = _consentGate.mayPersistToken;
 exports.getConsentSnapshot = _consentGate.getConsentSnapshot;
-exports.getGateView = _consentGate.getGateView;
 exports.subscribeToConsent = _consentGate.subscribeToConsent;
 exports.installConsentProvider = _consentGate.installConsentProvider;
-exports.getInstalledProviderName = _consentGate.getInstalledProviderName;
-exports.setConsentBufferLimit = _consentGate.setConsentBufferLimit;
-exports.getConsentGateStats = _consentGate.getConsentGateStats;
 exports.resetConsentGateForTests = _consentGate.resetConsentGateForTests;
 var _detectProvider = require("./detectProvider");
 exports.detectConsentProvider = _detectProvider.detectConsentProvider;

package/dist/cjs/privacy/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["_types","require","exports","UNKNOWN_CONSENT","_consentGate","transmit","mayTransmit","unlockOnUserAction","isUserEngaged","mayPersistIdentity","getConsentSnapshot","getGateView","subscribeToConsent","installConsentProvider","getInstalledProviderName","setConsentBufferLimit","getConsentGateStats","resetConsentGateForTests","_detectProvider","detectConsentProvider","initConsentGate","_consentOverride","CONSENT_OVERRIDE_KEY","CONSENT_OVERRIDE_QUERY_PARAM","getConsentOverride","setConsentOverride","_shopifyProvider","createShopifyConsentProvider","isShopifyHost","_oneTrustProvider","createOneTrustConsentProvider","isOneTrustHost","_hostSuppliedProvider","HOST_CONSENT_GLOBAL","createHostSuppliedConsentProvider","hasHostSuppliedConsent","publishHostConsent"],"sources":["../../../src/privacy/index.ts"],"sourcesContent":["export {\n  type ConsentState,\n  type ConsentPurpose,\n  type GatedPurpose,\n  type ConsentSnapshot,\n  type ConsentProvider,\n  UNKNOWN_CONSENT,\n} from './types';\n\nexport {\n  type GateView,\n  transmit,\n  mayTransmit,\n  unlockOnUserAction,\n  isUserEngaged,\n  mayPersistIdentity,\n  getConsentSnapshot,\n  getGateView,\n  subscribeToConsent,\n  installConsentProvider,\n  getInstalledProviderName,\n  setConsentBufferLimit,\n  getConsentGateStats,\n  resetConsentGateForTests,\n} from './consentGate';\n\nexport { detectConsentProvider, initConsentGate } from './detectProvider';\n\nexport {\n  CONSENT_OVERRIDE_KEY,\n  CONSENT_OVERRIDE_QUERY_PARAM,\n  getConsentOverride,\n  setConsentOverride,\n} from './consentOverride';\n\nexport {\n  createShopifyConsentProvider,\n  isShopifyHost,\n} from './providers/shopifyProvider';\nexport {\n  createOneTrustConsentProvider,\n  isOneTrustHost,\n} from './providers/oneTrustProvider';\nexport {\n  type HostConsentInput,\n  HOST_CONSENT_GLOBAL,\n  createHostSuppliedConsentProvider,\n  hasHostSuppliedConsent,\n  publishHostConsent,\n} from './providers/hostSuppliedProvider';\n"],"mappings":";;;;AAAA,IAAAA,MAAA,GAAAC,OAAA;AAOiBC,OAAA,CAAAC,eAAA,GAAAH,MAAA,CAAAG,eAAA;AAEjB,IAAAC,YAAA,GAAAH,OAAA;AAeuBC,OAAA,CAAAG,QAAA,GAAAD,YAAA,CAAAC,QAAA;AAAAH,OAAA,CAAAI,WAAA,GAAAF,YAAA,CAAAE,WAAA;AAAAJ,OAAA,CAAAK,kBAAA,GAAAH,YAAA,CAAAG,kBAAA;AAAAL,OAAA,CAAAM,aAAA,GAAAJ,YAAA,CAAAI,aAAA;AAAAN,OAAA,CAAAO,kBAAA,GAAAL,YAAA,CAAAK,kBAAA;AAAAP,OAAA,CAAAQ,kBAAA,GAAAN,YAAA,CAAAM,kBAAA;AAAAR,OAAA,CAAAS,WAAA,GAAAP,YAAA,CAAAO,WAAA;AAAAT,OAAA,CAAAU,kBAAA,GAAAR,YAAA,CAAAQ,kBAAA;AAAAV,OAAA,CAAAW,sBAAA,GAAAT,YAAA,CAAAS,sBAAA;AAAAX,OAAA,CAAAY,wBAAA,GAAAV,YAAA,CAAAU,wBAAA;AAAAZ,OAAA,CAAAa,qBAAA,GAAAX,YAAA,CAAAW,qBAAA;AAAAb,OAAA,CAAAc,mBAAA,GAAAZ,YAAA,CAAAY,mBAAA;AAAAd,OAAA,CAAAe,wBAAA,GAAAb,YAAA,CAAAa,wBAAA;AAEvB,IAAAC,eAAA,GAAAjB,OAAA;AAA0EC,OAAA,CAAAiB,qBAAA,GAAAD,eAAA,CAAAC,qBAAA;AAAAjB,OAAA,CAAAkB,eAAA,GAAAF,eAAA,CAAAE,eAAA;AAE1E,IAAAC,gBAAA,GAAApB,OAAA;AAK2BC,OAAA,CAAAoB,oBAAA,GAAAD,gBAAA,CAAAC,oBAAA;AAAApB,OAAA,CAAAqB,4BAAA,GAAAF,gBAAA,CAAAE,4BAAA;AAAArB,OAAA,CAAAsB,kBAAA,GAAAH,gBAAA,CAAAG,kBAAA;AAAAtB,OAAA,CAAAuB,kBAAA,GAAAJ,gBAAA,CAAAI,kBAAA;AAE3B,IAAAC,gBAAA,GAAAzB,OAAA;AAGqCC,OAAA,CAAAyB,4BAAA,GAAAD,gBAAA,CAAAC,4BAAA;AAAAzB,OAAA,CAAA0B,aAAA,GAAAF,gBAAA,CAAAE,aAAA;AACrC,IAAAC,iBAAA,GAAA5B,OAAA;AAGsCC,OAAA,CAAA4B,6BAAA,GAAAD,iBAAA,CAAAC,6BAAA;AAAA5B,OAAA,CAAA6B,cAAA,GAAAF,iBAAA,CAAAE,cAAA;AACtC,IAAAC,qBAAA,GAAA/B,OAAA;AAM0CC,OAAA,CAAA+B,mBAAA,GAAAD,qBAAA,CAAAC,mBAAA;AAAA/B,OAAA,CAAAgC,iCAAA,GAAAF,qBAAA,CAAAE,iCAAA;AAAAhC,OAAA,CAAAiC,sBAAA,GAAAH,qBAAA,CAAAG,sBAAA;AAAAjC,OAAA,CAAAkC,kBAAA,GAAAJ,qBAAA,CAAAI,kBAAA","ignoreList":[]}
+{"version":3,"names":["_types","require","exports","UNKNOWN_CONSENT","_consentGate","unlockOnUserAction","mayPersistToken","getConsentSnapshot","subscribeToConsent","installConsentProvider","resetConsentGateForTests","_detectProvider","detectConsentProvider","initConsentGate","_consentOverride","CONSENT_OVERRIDE_KEY","CONSENT_OVERRIDE_QUERY_PARAM","getConsentOverride","setConsentOverride","_shopifyProvider","createShopifyConsentProvider","isShopifyHost","_oneTrustProvider","createOneTrustConsentProvider","isOneTrustHost","_hostSuppliedProvider","HOST_CONSENT_GLOBAL","createHostSuppliedConsentProvider","hasHostSuppliedConsent","publishHostConsent"],"sources":["../../../src/privacy/index.ts"],"sourcesContent":["export {\n  type ConsentState,\n  type ConsentPurpose,\n  type GatedPurpose,\n  type ConsentSnapshot,\n  type ConsentProvider,\n  UNKNOWN_CONSENT,\n} from './types';\n\nexport {\n  unlockOnUserAction,\n  mayPersistToken,\n  getConsentSnapshot,\n  subscribeToConsent,\n  installConsentProvider,\n  resetConsentGateForTests,\n} from './consentGate';\n\nexport { detectConsentProvider, initConsentGate } from './detectProvider';\n\nexport {\n  CONSENT_OVERRIDE_KEY,\n  CONSENT_OVERRIDE_QUERY_PARAM,\n  getConsentOverride,\n  setConsentOverride,\n} from './consentOverride';\n\nexport {\n  createShopifyConsentProvider,\n  isShopifyHost,\n} from './providers/shopifyProvider';\nexport {\n  createOneTrustConsentProvider,\n  isOneTrustHost,\n} from './providers/oneTrustProvider';\nexport {\n  type HostConsentInput,\n  HOST_CONSENT_GLOBAL,\n  createHostSuppliedConsentProvider,\n  hasHostSuppliedConsent,\n  publishHostConsent,\n} from './providers/hostSuppliedProvider';\n"],"mappings":";;;;AAAA,IAAAA,MAAA,GAAAC,OAAA;AAOiBC,OAAA,CAAAC,eAAA,GAAAH,MAAA,CAAAG,eAAA;AAEjB,IAAAC,YAAA,GAAAH,OAAA;AAOuBC,OAAA,CAAAG,kBAAA,GAAAD,YAAA,CAAAC,kBAAA;AAAAH,OAAA,CAAAI,eAAA,GAAAF,YAAA,CAAAE,eAAA;AAAAJ,OAAA,CAAAK,kBAAA,GAAAH,YAAA,CAAAG,kBAAA;AAAAL,OAAA,CAAAM,kBAAA,GAAAJ,YAAA,CAAAI,kBAAA;AAAAN,OAAA,CAAAO,sBAAA,GAAAL,YAAA,CAAAK,sBAAA;AAAAP,OAAA,CAAAQ,wBAAA,GAAAN,YAAA,CAAAM,wBAAA;AAEvB,IAAAC,eAAA,GAAAV,OAAA;AAA0EC,OAAA,CAAAU,qBAAA,GAAAD,eAAA,CAAAC,qBAAA;AAAAV,OAAA,CAAAW,eAAA,GAAAF,eAAA,CAAAE,eAAA;AAE1E,IAAAC,gBAAA,GAAAb,OAAA;AAK2BC,OAAA,CAAAa,oBAAA,GAAAD,gBAAA,CAAAC,oBAAA;AAAAb,OAAA,CAAAc,4BAAA,GAAAF,gBAAA,CAAAE,4BAAA;AAAAd,OAAA,CAAAe,kBAAA,GAAAH,gBAAA,CAAAG,kBAAA;AAAAf,OAAA,CAAAgB,kBAAA,GAAAJ,gBAAA,CAAAI,kBAAA;AAE3B,IAAAC,gBAAA,GAAAlB,OAAA;AAGqCC,OAAA,CAAAkB,4BAAA,GAAAD,gBAAA,CAAAC,4BAAA;AAAAlB,OAAA,CAAAmB,aAAA,GAAAF,gBAAA,CAAAE,aAAA;AACrC,IAAAC,iBAAA,GAAArB,OAAA;AAGsCC,OAAA,CAAAqB,6BAAA,GAAAD,iBAAA,CAAAC,6BAAA;AAAArB,OAAA,CAAAsB,cAAA,GAAAF,iBAAA,CAAAE,cAAA;AACtC,IAAAC,qBAAA,GAAAxB,OAAA;AAM0CC,OAAA,CAAAwB,mBAAA,GAAAD,qBAAA,CAAAC,mBAAA;AAAAxB,OAAA,CAAAyB,iCAAA,GAAAF,qBAAA,CAAAE,iCAAA;AAAAzB,OAAA,CAAA0B,sBAAA,GAAAH,qBAAA,CAAAG,sBAAA;AAAA1B,OAAA,CAAA2B,kBAAA,GAAAJ,qBAAA,CAAAI,kBAAA","ignoreList":[]}

package/dist/cjs/styles/base-tokens.css

@@ -31,6 +31,25 @@
   --input: 0 0% 89.8%;
   --ring: 0 0% 3.9%;
 
+  /* Owner chrome tokens — HSL triplets. The Customize panel's own greys (ADR
+   * 0243), held apart from the store's palette ON PURPOSE: the panel edits and
+   * previews `--background`, `--card` and the rest, so chrome painted with them
+   * repaints itself — a dark scheme turned the panel black and its labels
+   * unreadable. Nothing writes these: they are not in THEME_TOKEN_CONTRACT, no
+   * store import, scheme or owner override carries them, and an unknown key
+   * from a flat map lands on its `--web5-host-*` alias, never here. Light only
+   * (no `.dark` twin) — admin chrome, not themed. */
+  --web5-chrome-surface: 0 0% 100%;
+  --web5-chrome-foreground: 0 0% 18.8%;
+  --web5-chrome-muted-foreground: 0 0% 38%;
+  --web5-chrome-subtle-foreground: 210 4.5% 56.9%;
+  --web5-chrome-border: 0 0% 89%;
+  --web5-chrome-border-strong: 0 0% 71%;
+  --web5-chrome-tint: 0 0% 98%;
+  --web5-chrome-accent: 0 0% 18.8%;
+  --web5-chrome-accent-foreground: 0 0% 100%;
+  --web5-chrome-destructive: 9 72.2% 44.9%;
+
   /* Typography tokens */
   --font-sans: ui-sans-serif, system-ui, sans-serif;
   --font-serif: serif;

package/dist/cjs/styles/tailwind-theme.css

@@ -47,6 +47,18 @@
   --color-text-accent-hover: var(--text-accent-hover);
   --color-accent-border: var(--accent-border);
 
+  /* Owner chrome — the Customize panel's store-independent greys */
+  --color-web5-chrome-surface: hsl(var(--web5-chrome-surface));
+  --color-web5-chrome-foreground: hsl(var(--web5-chrome-foreground));
+  --color-web5-chrome-muted-foreground: hsl(var(--web5-chrome-muted-foreground));
+  --color-web5-chrome-subtle-foreground: hsl(var(--web5-chrome-subtle-foreground));
+  --color-web5-chrome-border: hsl(var(--web5-chrome-border));
+  --color-web5-chrome-border-strong: hsl(var(--web5-chrome-border-strong));
+  --color-web5-chrome-tint: hsl(var(--web5-chrome-tint));
+  --color-web5-chrome-accent: hsl(var(--web5-chrome-accent));
+  --color-web5-chrome-accent-foreground: hsl(var(--web5-chrome-accent-foreground));
+  --color-web5-chrome-destructive: hsl(var(--web5-chrome-destructive));
+
   --radius-sm: calc(var(--radius) - 4px);
   --radius-md: calc(var(--radius) - 2px);
   --radius-lg: var(--radius);

package/dist/cjs/theme/chromeTokens.js

@@ -0,0 +1,60 @@
+"use strict";
+
+exports.__esModule = true;
+exports.WEB5_CHROME_TOKENS = void 0;
+exports.web5ChromeProperties = web5ChromeProperties;
+exports.web5ChromeProperty = void 0;
+/**
+ * The owner panel's own chrome colours (`--web5-chrome-*`).
+ *
+ * The Customize panel edits and previews the store's colour tokens, so its
+ * chrome cannot be painted with them: a dark scheme would turn its labels
+ * dark-on-dark and a cream card colour would turn the whole panel cream. It
+ * takes these instead — light, neutral, and written by nothing the store or the
+ * merchant controls.
+ *
+ * WHY A CONSTANT AND NOT ONLY CSS. `base-tokens.css` declares the same values,
+ * but that stylesheet reaches a page through the CLIENT bundle, and every
+ * client bundle pins the core version it was built against. A storefront whose
+ * template predates these tokens would leave the panel's `hsl(var(...))`
+ * invalid — a transparent panel inheriting the scheme's text colour. The panel
+ * lives in web50-server-ui, which bundles its own core, so it writes each value
+ * as the `var()` fallback (`hsl(var(--web5-chrome-surface, 0 0% 100%))`, see
+ * `chrome()` in the TemplatePicker) and never depends on the client's CSS.
+ * `chromeTokens.spec.ts` keeps this map and `base-tokens.css` equal.
+ *
+ * Bare HSL triplets, like every colour token: callers wrap them in `hsl()`.
+ * A leaf module (no CSS imports), for the reason `tokenContract.ts` gives.
+ */
+
+/** Token name (without the `--web5-chrome-` prefix) → bare HSL triplet. */
+const WEB5_CHROME_TOKENS = exports.WEB5_CHROME_TOKENS = Object.freeze({
+  surface: '0 0% 100%',
+  foreground: '0 0% 18.8%',
+  'muted-foreground': '0 0% 38%',
+  'subtle-foreground': '210 4.5% 56.9%',
+  border: '0 0% 89%',
+  'border-strong': '0 0% 71%',
+  tint: '0 0% 98%',
+  accent: '0 0% 18.8%',
+  'accent-foreground': '0 0% 100%',
+  destructive: '9 72.2% 44.9%'
+});
+/** `surface` → `--web5-chrome-surface`. */
+const web5ChromeProperty = token => `--web5-chrome-${token}`;
+
+/**
+ * Every chrome token as custom properties, ready to spread into an element's
+ * inline style (`style={{ ...web5ChromeProperties(), ... }}`), so the element
+ * and everything inside it resolve `var(--web5-chrome-*)` without any
+ * stylesheet.
+ */
+exports.web5ChromeProperty = web5ChromeProperty;
+function web5ChromeProperties() {
+  const out = {};
+  for (const [token, value] of Object.entries(WEB5_CHROME_TOKENS)) {
+    out[web5ChromeProperty(token)] = value;
+  }
+  return out;
+}
+//# sourceMappingURL=chromeTokens.js.map

package/dist/cjs/theme/chromeTokens.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["WEB5_CHROME_TOKENS","exports","Object","freeze","surface","foreground","border","tint","accent","destructive","web5ChromeProperty","token","web5ChromeProperties","out","value","entries"],"sources":["../../../src/theme/chromeTokens.ts"],"sourcesContent":["/**\n * The owner panel's own chrome colours (`--web5-chrome-*`).\n *\n * The Customize panel edits and previews the store's colour tokens, so its\n * chrome cannot be painted with them: a dark scheme would turn its labels\n * dark-on-dark and a cream card colour would turn the whole panel cream. It\n * takes these instead — light, neutral, and written by nothing the store or the\n * merchant controls.\n *\n * WHY A CONSTANT AND NOT ONLY CSS. `base-tokens.css` declares the same values,\n * but that stylesheet reaches a page through the CLIENT bundle, and every\n * client bundle pins the core version it was built against. A storefront whose\n * template predates these tokens would leave the panel's `hsl(var(...))`\n * invalid — a transparent panel inheriting the scheme's text colour. The panel\n * lives in web50-server-ui, which bundles its own core, so it writes each value\n * as the `var()` fallback (`hsl(var(--web5-chrome-surface, 0 0% 100%))`, see\n * `chrome()` in the TemplatePicker) and never depends on the client's CSS.\n * `chromeTokens.spec.ts` keeps this map and `base-tokens.css` equal.\n *\n * Bare HSL triplets, like every colour token: callers wrap them in `hsl()`.\n * A leaf module (no CSS imports), for the reason `tokenContract.ts` gives.\n */\n\n/** Token name (without the `--web5-chrome-` prefix) → bare HSL triplet. */\nexport const WEB5_CHROME_TOKENS = Object.freeze({\n  surface: '0 0% 100%',\n  foreground: '0 0% 18.8%',\n  'muted-foreground': '0 0% 38%',\n  'subtle-foreground': '210 4.5% 56.9%',\n  border: '0 0% 89%',\n  'border-strong': '0 0% 71%',\n  tint: '0 0% 98%',\n  accent: '0 0% 18.8%',\n  'accent-foreground': '0 0% 100%',\n  destructive: '9 72.2% 44.9%',\n} as const);\n\nexport type Web5ChromeToken = keyof typeof WEB5_CHROME_TOKENS;\n\n/** `surface` → `--web5-chrome-surface`. */\nexport const web5ChromeProperty = (token: Web5ChromeToken): `--web5-chrome-${string}` =>\n  `--web5-chrome-${token}`;\n\n/**\n * Every chrome token as custom properties, ready to spread into an element's\n * inline style (`style={{ ...web5ChromeProperties(), ... }}`), so the element\n * and everything inside it resolve `var(--web5-chrome-*)` without any\n * stylesheet.\n */\nexport function web5ChromeProperties(): Record<`--web5-chrome-${string}`, string> {\n  const out = {} as Record<`--web5-chrome-${string}`, string>;\n  for (const [token, value] of Object.entries(WEB5_CHROME_TOKENS)) {\n    out[web5ChromeProperty(token as Web5ChromeToken)] = value;\n  }\n  return out;\n}\n"],"mappings":";;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACO,MAAMA,kBAAkB,GAAAC,OAAA,CAAAD,kBAAA,GAAGE,MAAM,CAACC,MAAM,CAAC;EAC9CC,OAAO,EAAE,WAAW;EACpBC,UAAU,EAAE,YAAY;EACxB,kBAAkB,EAAE,UAAU;EAC9B,mBAAmB,EAAE,gBAAgB;EACrCC,MAAM,EAAE,UAAU;EAClB,eAAe,EAAE,UAAU;EAC3BC,IAAI,EAAE,UAAU;EAChBC,MAAM,EAAE,YAAY;EACpB,mBAAmB,EAAE,WAAW;EAChCC,WAAW,EAAE;AACf,CAAU,CAAC;AAIX;AACO,MAAMC,kBAAkB,GAAIC,KAAsB,IACvD,iBAAiBA,KAAK,EAAE;;AAE1B;AACA;AACA;AACA;AACA;AACA;AALAV,OAAA,CAAAS,kBAAA,GAAAA,kBAAA;AAMO,SAASE,oBAAoBA,CAAA,EAA8C;EAChF,MAAMC,GAAG,GAAG,CAAC,CAA8C;EAC3D,KAAK,MAAM,CAACF,KAAK,EAAEG,KAAK,CAAC,IAAIZ,MAAM,CAACa,OAAO,CAACf,kBAAkB,CAAC,EAAE;IAC/Da,GAAG,CAACH,kBAAkB,CAACC,KAAwB,CAAC,CAAC,GAAGG,KAAK;EAC3D;EACA,OAAOD,GAAG;AACZ","ignoreList":[]}