@wix/web5-core 1.63.48 → 1.63.49

package/dist/cjs/privacy/providers/oneTrustProvider.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["ANALYTICS_CATEGORY","MARKETING_CATEGORY","readGroups","window","groups","OnetrustActiveGroups","isOneTrustHost","exports","readSnapshot","console","debug","analytics","marketing","performance","includes","createOneTrustConsentProvider","name","read","subscribe","onChange","publish","addEventListener","removeEventListener"],"sources":["../../../../src/privacy/providers/oneTrustProvider.ts"],"sourcesContent":["/**\n * OneTrust provider — DL #218.\n *\n * Lifted from the consent check that used to live inside\n * `utils/analyticsEvents.ts`, with one deliberate behaviour change: that\n * function returned `true` when OneTrust was absent (\"host is responsible for\n * loading OneTrust\"), which on a Shopify storefront meant unconditional\n * default-allow. Absence is no longer this provider's problem — it is only\n * selected when OneTrust is actually on the page, and absence is handled by\n * the gate's own default.\n */\n\nimport type { ConsentProvider, ConsentSnapshot } from '../types';\n\n/** OneTrust's default taxonomy: C0002 is the performance/analytics category. */\nconst ANALYTICS_CATEGORY = 'C0002';\n/** C0004 is targeting/advertising. */\nconst MARKETING_CATEGORY = 'C0004';\n\nconst readGroups = (): string | null => {\n  if (typeof window === 'undefined') {\n    return null;\n  }\n  const groups = (window as unknown as { OnetrustActiveGroups?: unknown })\n    .OnetrustActiveGroups;\n  return typeof groups === 'string' ? groups : null;\n};\n\nexport const isOneTrustHost = (): boolean => readGroups() !== null;\n\nconst readSnapshot = (): ConsentSnapshot => {\n  const groups = readGroups();\n  if (groups !== null) {\n    try {\n      console.debug(`[w5-consent] onetrust: active groups \"${groups}\"`);\n    } catch {\n      /* never break on a console */\n    }\n  }\n  if (groups === null) {\n    return {\n      analytics: 'unknown',\n      marketing: 'unknown',\n      performance: 'unknown',\n    };\n  }\n  // OneTrust publishes the *active* groups, so a category that is absent from\n  // a string OneTrust has written is a refusal, not silence.\n  const analytics = groups.includes(ANALYTICS_CATEGORY) ? 'granted' : 'denied';\n  const marketing = groups.includes(MARKETING_CATEGORY) ? 'granted' : 'denied';\n  return { analytics, marketing, performance: analytics };\n};\n\nexport const createOneTrustConsentProvider = (): ConsentProvider => ({\n  name: 'onetrust',\n\n  read: readSnapshot,\n\n  subscribe(onChange) {\n    const publish = () => onChange(readSnapshot());\n    if (typeof window === 'undefined') {\n      return () => {};\n    }\n    // OneTrust fires this on every banner interaction.\n    window.addEventListener('OneTrustGroupsUpdated', publish);\n    return () => {\n      window.removeEventListener('OneTrustGroupsUpdated', publish);\n    };\n  },\n});\n"],"mappings":";;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAIA;AACA,MAAMA,kBAAkB,GAAG,OAAO;AAClC;AACA,MAAMC,kBAAkB,GAAG,OAAO;AAElC,MAAMC,UAAU,GAAGA,CAAA,KAAqB;EACtC,IAAI,OAAOC,MAAM,KAAK,WAAW,EAAE;IACjC,OAAO,IAAI;EACb;EACA,MAAMC,MAAM,GAAID,MAAM,CACnBE,oBAAoB;EACvB,OAAO,OAAOD,MAAM,KAAK,QAAQ,GAAGA,MAAM,GAAG,IAAI;AACnD,CAAC;AAEM,MAAME,cAAc,GAAGA,CAAA,KAAeJ,UAAU,CAAC,CAAC,KAAK,IAAI;AAACK,OAAA,CAAAD,cAAA,GAAAA,cAAA;AAEnE,MAAME,YAAY,GAAGA,CAAA,KAAuB;EAC1C,MAAMJ,MAAM,GAAGF,UAAU,CAAC,CAAC;EAC3B,IAAIE,MAAM,KAAK,IAAI,EAAE;IACnB,IAAI;MACFK,OAAO,CAACC,KAAK,CAAC,yCAAyCN,MAAM,GAAG,CAAC;IACnE,CAAC,CAAC,MAAM;MACN;IAAA;EAEJ;EACA,IAAIA,MAAM,KAAK,IAAI,EAAE;IACnB,OAAO;MACLO,SAAS,EAAE,SAAS;MACpBC,SAAS,EAAE,SAAS;MACpBC,WAAW,EAAE;IACf,CAAC;EACH;EACA;EACA;EACA,MAAMF,SAAS,GAAGP,MAAM,CAACU,QAAQ,CAACd,kBAAkB,CAAC,GAAG,SAAS,GAAG,QAAQ;EAC5E,MAAMY,SAAS,GAAGR,MAAM,CAACU,QAAQ,CAACb,kBAAkB,CAAC,GAAG,SAAS,GAAG,QAAQ;EAC5E,OAAO;IAAEU,SAAS;IAAEC,SAAS;IAAEC,WAAW,EAAEF;EAAU,CAAC;AACzD,CAAC;AAEM,MAAMI,6BAA6B,GAAGA,CAAA,MAAwB;EACnEC,IAAI,EAAE,UAAU;EAEhBC,IAAI,EAAET,YAAY;EAElBU,SAASA,CAACC,QAAQ,EAAE;IAClB,MAAMC,OAAO,GAAGA,CAAA,KAAMD,QAAQ,CAACX,YAAY,CAAC,CAAC,CAAC;IAC9C,IAAI,OAAOL,MAAM,KAAK,WAAW,EAAE;MACjC,OAAO,MAAM,CAAC,CAAC;IACjB;IACA;IACAA,MAAM,CAACkB,gBAAgB,CAAC,uBAAuB,EAAED,OAAO,CAAC;IACzD,OAAO,MAAM;MACXjB,MAAM,CAACmB,mBAAmB,CAAC,uBAAuB,EAAEF,OAAO,CAAC;IAC9D,CAAC;EACH;AACF,CAAC,CAAC;AAACb,OAAA,CAAAQ,6BAAA,GAAAA,6BAAA","ignoreList":[]}

package/dist/cjs/privacy/providers/shopifyProvider.js

@@ -1,181 +0,0 @@
-"use strict";
-
-exports.__esModule = true;
-exports.isShopifyHost = exports.createShopifyConsentProvider = void 0;
-var _types = require("../types");
-/**
- * Shopify Customer Privacy API provider — DL #218.
- *
- * Two things about this API shape the provider:
- *
- * 1. **It is not on the page by default.** `window.Shopify.customerPrivacy` is
- *    `undefined` until somebody asks for it with `Shopify.loadFeatures`. The
- *    theme app extension warms it so it is ready before the bundle mounts;
- *    this provider still requests it, because the extension may not be
- *    installed and the request is idempotent.
- *
- * 2. **`visitorConsentCollected` may have already fired.** The bundle executes
- *    into an already-rendered storefront page (DL #217), so `read()` answers
- *    from current state and the event is only ever an update.
- *
- * The region rule is the one judgement encoded here, and it keys off
- * `isRegulationEnforced()` rather than `shouldShowBanner()`. The two are not
- * interchangeable: the banner reflects what the *merchant* configured, while
- * enforcement reflects what the *visitor's jurisdiction* requires. A store with
- * an empty consent configuration reports "no banner needed" everywhere,
- * including inside the EU.
- */
-
-const CONSENT_FEATURE = {
-  name: 'consent-tracking-api',
-  version: '0.1'
-};
-const log = (...args) => {
-  try {
-    console.debug('[w5-consent] shopify:', ...args);
-  } catch {
-    /* never break on a console */
-  }
-};
-const getShopify = () => {
-  if (typeof window === 'undefined') {
-    return null;
-  }
-  return window.Shopify ?? null;
-};
-const isShopifyHost = () => getShopify() !== null;
-exports.isShopifyHost = isShopifyHost;
-const toState = value => {
-  if (value === 'yes') {
-    return 'granted';
-  }
-  if (value === 'no') {
-    return 'denied';
-  }
-  return null;
-};
-const readSnapshot = () => {
-  var _getShopify;
-  const privacy = (_getShopify = getShopify()) == null ? void 0 : _getShopify.customerPrivacy;
-  if (!privacy) {
-    log('customerPrivacy API not on the page — no answer available (store has no privacy configuration, or loadFeatures has not resolved yet)');
-    // The API has not loaded (or the store has no privacy configuration at
-    // all). Not an answer — the gate holds, and the visitor's own action is
-    // what unlocks the session.
-    return _types.UNKNOWN_CONSENT;
-  }
-  let consent = {};
-  try {
-    consent = (privacy.currentVisitorConsent == null ? void 0 : privacy.currentVisitorConsent()) ?? {};
-  } catch {
-    // Present but not ready — treat as no answer yet.
-  }
-  const explicitAnalytics = toState(consent.analytics);
-  const explicitMarketing = toState(consent.marketing);
-  let allowed = false;
-  try {
-    allowed = (privacy.analyticsProcessingAllowed == null ? void 0 : privacy.analyticsProcessingAllowed()) === true;
-  } catch {
-    allowed = false;
-  }
-
-  // Is a privacy regulation in force for *this visitor's* region? This is the
-  // question that matters, and it is not the same question as "is a banner
-  // being shown" — see the comment on `enforced` below.
-  let enforced = null;
-  let regulation = '';
-  let region = '';
-  try {
-    if (typeof privacy.isRegulationEnforced === 'function') {
-      enforced = privacy.isRegulationEnforced() === true;
-    }
-    regulation = (privacy.getRegulation == null ? void 0 : privacy.getRegulation()) ?? '';
-    region = (privacy.getRegion == null ? void 0 : privacy.getRegion()) ?? '';
-  } catch {
-    enforced = null;
-  }
-  let bannerRequired = true;
-  try {
-    bannerRequired = (privacy.shouldShowBanner == null ? void 0 : privacy.shouldShowBanner()) !== false;
-  } catch {
-    bannerRequired = true;
-  }
-
-  /*
-   * Measured on a live store from a Frankfurt IP, with no consent recorded:
-   *
-   *   region 'DEBE' · regulation 'GDPR' · isRegulationEnforced() true
-   *   shouldShowBanner() false · analyticsProcessingAllowed() TRUE
-   *   getShopPrefs() { limit: [] }
-   *
-   * Shopify said tracking was allowed for a GDPR-protected visitor who had
-   * never been asked, because the *merchant* had configured no consent
-   * preferences. `shouldShowBanner()` and `analyticsProcessingAllowed()` both
-   * describe the merchant's setup; neither is a statement about a legal basis.
-   * A merchant's misconfiguration must not become our tracking decision, so
-   * under an enforced regulation an absent answer stays `unknown` and the gate
-   * holds — the visitor's own prompt is then the only thing that unlocks them.
-   */
-  const permissiveDefault = allowed || !bannerRequired;
-  const fallbackWhenUnenforceable = permissiveDefault ? 'granted' : 'unknown';
-  const analytics = explicitAnalytics ?? (enforced === true ? 'unknown' : fallbackWhenUnenforceable);
-  const marketing = explicitMarketing ?? (enforced === true ? 'unknown' : !bannerRequired ? 'granted' : 'unknown');
-  log(`read — visitorConsent.analytics=${consent.analytics ?? '(unset)'} ` + `analyticsProcessingAllowed=${allowed} bannerRequired=${bannerRequired} ` + `region=${region || '?'} regulation=${regulation || '?'} enforced=${enforced === null ? 'unavailable' : enforced}` + (enforced === true && explicitAnalytics === null ? ' → regulated and unanswered, holding' : '') + ` ⇒ ${analytics}`);
-  return {
-    analytics,
-    marketing,
-    // Shopify has no separate performance bucket. Load telemetry carries an
-    // app name and a session id to a Wix endpoint, so it answers to the same
-    // answer analytics does rather than riding for free.
-    performance: analytics
-  };
-};
-
-/**
- * Ask Shopify to load the consent API if it is not already there. Safe to call
- * more than once; the callback re-reads whatever state arrives.
- */
-const requestConsentApi = onReady => {
-  const shopify = getShopify();
-  if (!shopify || shopify.customerPrivacy || !shopify.loadFeatures) {
-    return;
-  }
-  try {
-    log('requesting consent-tracking-api via Shopify.loadFeatures…');
-    shopify.loadFeatures([CONSENT_FEATURE], error => {
-      if (error) {
-        log('loadFeatures failed — gate stays held', error);
-        return;
-      }
-      log('loadFeatures resolved — re-reading consent');
-      onReady();
-    });
-  } catch {
-    // Storefronts without the feature simply never resolve; the gate stays
-    // held and engagement remains the only unlock.
-  }
-};
-const createShopifyConsentProvider = () => ({
-  name: 'shopify-customer-privacy',
-  read: readSnapshot,
-  subscribe(onChange) {
-    const publish = () => {
-      log('visitorConsentCollected — the visitor answered the banner');
-      onChange(readSnapshot());
-    };
-
-    // The visitor may have answered the banner before this bundle existed, so
-    // the event is an update — never the first read.
-    if (typeof document !== 'undefined') {
-      document.addEventListener('visitorConsentCollected', publish);
-    }
-    requestConsentApi(() => onChange(readSnapshot()));
-    return () => {
-      if (typeof document !== 'undefined') {
-        document.removeEventListener('visitorConsentCollected', publish);
-      }
-    };
-  }
-});
-exports.createShopifyConsentProvider = createShopifyConsentProvider;
-//# sourceMappingURL=shopifyProvider.js.map

package/dist/cjs/privacy/providers/shopifyProvider.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["_types","require","CONSENT_FEATURE","name","version","log","args","console","debug","getShopify","window","Shopify","isShopifyHost","exports","toState","value","readSnapshot","_getShopify","privacy","customerPrivacy","UNKNOWN_CONSENT","consent","currentVisitorConsent","explicitAnalytics","analytics","explicitMarketing","marketing","allowed","analyticsProcessingAllowed","enforced","regulation","region","isRegulationEnforced","getRegulation","getRegion","bannerRequired","shouldShowBanner","permissiveDefault","fallbackWhenUnenforceable","performance","requestConsentApi","onReady","shopify","loadFeatures","error","createShopifyConsentProvider","read","subscribe","onChange","publish","document","addEventListener","removeEventListener"],"sources":["../../../../src/privacy/providers/shopifyProvider.ts"],"sourcesContent":["/**\n * Shopify Customer Privacy API provider — DL #218.\n *\n * Two things about this API shape the provider:\n *\n * 1. **It is not on the page by default.** `window.Shopify.customerPrivacy` is\n *    `undefined` until somebody asks for it with `Shopify.loadFeatures`. The\n *    theme app extension warms it so it is ready before the bundle mounts;\n *    this provider still requests it, because the extension may not be\n *    installed and the request is idempotent.\n *\n * 2. **`visitorConsentCollected` may have already fired.** The bundle executes\n *    into an already-rendered storefront page (DL #217), so `read()` answers\n *    from current state and the event is only ever an update.\n *\n * The region rule is the one judgement encoded here, and it keys off\n * `isRegulationEnforced()` rather than `shouldShowBanner()`. The two are not\n * interchangeable: the banner reflects what the *merchant* configured, while\n * enforcement reflects what the *visitor's jurisdiction* requires. A store with\n * an empty consent configuration reports \"no banner needed\" everywhere,\n * including inside the EU.\n */\n\nimport {\n  UNKNOWN_CONSENT,\n  type ConsentProvider,\n  type ConsentSnapshot,\n  type ConsentState,\n} from '../types';\n\ntype ShopifyConsentValue = 'yes' | 'no' | '' | undefined;\n\ninterface ShopifyVisitorConsent {\n  analytics?: ShopifyConsentValue;\n  marketing?: ShopifyConsentValue;\n  preferences?: ShopifyConsentValue;\n  sale_of_data?: ShopifyConsentValue;\n}\n\ninterface ShopifyCustomerPrivacy {\n  analyticsProcessingAllowed?: () => boolean;\n  marketingAllowed?: () => boolean;\n  currentVisitorConsent?: () => ShopifyVisitorConsent;\n  shouldShowBanner?: () => boolean;\n  /** Whether a privacy regulation applies to this visitor's region. */\n  isRegulationEnforced?: () => boolean;\n  /** e.g. 'GDPR', 'CCPA'. */\n  getRegulation?: () => string;\n  /** e.g. 'DEBE' — country + subdivision. */\n  getRegion?: () => string;\n}\n\ninterface ShopifyGlobal {\n  customerPrivacy?: ShopifyCustomerPrivacy;\n  loadFeatures?: (\n    features: { name: string; version: string }[],\n    callback: (error?: unknown) => void,\n  ) => void;\n}\n\nconst CONSENT_FEATURE = { name: 'consent-tracking-api', version: '0.1' };\n\nconst log = (...args: unknown[]): void => {\n  try {\n    console.debug('[w5-consent] shopify:', ...args);\n  } catch {\n    /* never break on a console */\n  }\n};\n\nconst getShopify = (): ShopifyGlobal | null => {\n  if (typeof window === 'undefined') {\n    return null;\n  }\n  return (window as unknown as { Shopify?: ShopifyGlobal }).Shopify ?? null;\n};\n\nexport const isShopifyHost = (): boolean => getShopify() !== null;\n\nconst toState = (value: ShopifyConsentValue): ConsentState | null => {\n  if (value === 'yes') {\n    return 'granted';\n  }\n  if (value === 'no') {\n    return 'denied';\n  }\n  return null;\n};\n\nconst readSnapshot = (): ConsentSnapshot => {\n  const privacy = getShopify()?.customerPrivacy;\n  if (!privacy) {\n    log(\n      'customerPrivacy API not on the page — no answer available (store has no privacy configuration, or loadFeatures has not resolved yet)',\n    );\n    // The API has not loaded (or the store has no privacy configuration at\n    // all). Not an answer — the gate holds, and the visitor's own action is\n    // what unlocks the session.\n    return UNKNOWN_CONSENT;\n  }\n\n  let consent: ShopifyVisitorConsent = {};\n  try {\n    consent = privacy.currentVisitorConsent?.() ?? {};\n  } catch {\n    // Present but not ready — treat as no answer yet.\n  }\n\n  const explicitAnalytics = toState(consent.analytics);\n  const explicitMarketing = toState(consent.marketing);\n\n  let allowed = false;\n  try {\n    allowed = privacy.analyticsProcessingAllowed?.() === true;\n  } catch {\n    allowed = false;\n  }\n\n  // Is a privacy regulation in force for *this visitor's* region? This is the\n  // question that matters, and it is not the same question as \"is a banner\n  // being shown\" — see the comment on `enforced` below.\n  let enforced: boolean | null = null;\n  let regulation = '';\n  let region = '';\n  try {\n    if (typeof privacy.isRegulationEnforced === 'function') {\n      enforced = privacy.isRegulationEnforced() === true;\n    }\n    regulation = privacy.getRegulation?.() ?? '';\n    region = privacy.getRegion?.() ?? '';\n  } catch {\n    enforced = null;\n  }\n\n  let bannerRequired = true;\n  try {\n    bannerRequired = privacy.shouldShowBanner?.() !== false;\n  } catch {\n    bannerRequired = true;\n  }\n\n  /*\n   * Measured on a live store from a Frankfurt IP, with no consent recorded:\n   *\n   *   region 'DEBE' · regulation 'GDPR' · isRegulationEnforced() true\n   *   shouldShowBanner() false · analyticsProcessingAllowed() TRUE\n   *   getShopPrefs() { limit: [] }\n   *\n   * Shopify said tracking was allowed for a GDPR-protected visitor who had\n   * never been asked, because the *merchant* had configured no consent\n   * preferences. `shouldShowBanner()` and `analyticsProcessingAllowed()` both\n   * describe the merchant's setup; neither is a statement about a legal basis.\n   * A merchant's misconfiguration must not become our tracking decision, so\n   * under an enforced regulation an absent answer stays `unknown` and the gate\n   * holds — the visitor's own prompt is then the only thing that unlocks them.\n   */\n  const permissiveDefault = allowed || !bannerRequired;\n  const fallbackWhenUnenforceable = permissiveDefault ? 'granted' : 'unknown';\n\n  const analytics: ConsentState =\n    explicitAnalytics ??\n    (enforced === true ? 'unknown' : fallbackWhenUnenforceable);\n\n  const marketing: ConsentState =\n    explicitMarketing ??\n    (enforced === true ? 'unknown' : !bannerRequired ? 'granted' : 'unknown');\n\n  log(\n    `read — visitorConsent.analytics=${consent.analytics ?? '(unset)'} ` +\n      `analyticsProcessingAllowed=${allowed} bannerRequired=${bannerRequired} ` +\n      `region=${region || '?'} regulation=${regulation || '?'} enforced=${\n        enforced === null ? 'unavailable' : enforced\n      }` +\n      (enforced === true && explicitAnalytics === null\n        ? ' → regulated and unanswered, holding'\n        : '') +\n      ` ⇒ ${analytics}`,\n  );\n\n  return {\n    analytics,\n    marketing,\n    // Shopify has no separate performance bucket. Load telemetry carries an\n    // app name and a session id to a Wix endpoint, so it answers to the same\n    // answer analytics does rather than riding for free.\n    performance: analytics,\n  };\n};\n\n/**\n * Ask Shopify to load the consent API if it is not already there. Safe to call\n * more than once; the callback re-reads whatever state arrives.\n */\nconst requestConsentApi = (onReady: () => void): void => {\n  const shopify = getShopify();\n  if (!shopify || shopify.customerPrivacy || !shopify.loadFeatures) {\n    return;\n  }\n  try {\n    log('requesting consent-tracking-api via Shopify.loadFeatures…');\n    shopify.loadFeatures([CONSENT_FEATURE], (error) => {\n      if (error) {\n        log('loadFeatures failed — gate stays held', error);\n        return;\n      }\n      log('loadFeatures resolved — re-reading consent');\n      onReady();\n    });\n  } catch {\n    // Storefronts without the feature simply never resolve; the gate stays\n    // held and engagement remains the only unlock.\n  }\n};\n\nexport const createShopifyConsentProvider = (): ConsentProvider => ({\n  name: 'shopify-customer-privacy',\n\n  read: readSnapshot,\n\n  subscribe(onChange) {\n    const publish = () => {\n      log('visitorConsentCollected — the visitor answered the banner');\n      onChange(readSnapshot());\n    };\n\n    // The visitor may have answered the banner before this bundle existed, so\n    // the event is an update — never the first read.\n    if (typeof document !== 'undefined') {\n      document.addEventListener('visitorConsentCollected', publish);\n    }\n    requestConsentApi(() => onChange(readSnapshot()));\n\n    return () => {\n      if (typeof document !== 'undefined') {\n        document.removeEventListener('visitorConsentCollected', publish);\n      }\n    };\n  },\n});\n"],"mappings":";;;;AAuBA,IAAAA,MAAA,GAAAC,OAAA;AAvBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAuCA,MAAMC,eAAe,GAAG;EAAEC,IAAI,EAAE,sBAAsB;EAAEC,OAAO,EAAE;AAAM,CAAC;AAExE,MAAMC,GAAG,GAAGA,CAAC,GAAGC,IAAe,KAAW;EACxC,IAAI;IACFC,OAAO,CAACC,KAAK,CAAC,uBAAuB,EAAE,GAAGF,IAAI,CAAC;EACjD,CAAC,CAAC,MAAM;IACN;EAAA;AAEJ,CAAC;AAED,MAAMG,UAAU,GAAGA,CAAA,KAA4B;EAC7C,IAAI,OAAOC,MAAM,KAAK,WAAW,EAAE;IACjC,OAAO,IAAI;EACb;EACA,OAAQA,MAAM,CAA4CC,OAAO,IAAI,IAAI;AAC3E,CAAC;AAEM,MAAMC,aAAa,GAAGA,CAAA,KAAeH,UAAU,CAAC,CAAC,KAAK,IAAI;AAACI,OAAA,CAAAD,aAAA,GAAAA,aAAA;AAElE,MAAME,OAAO,GAAIC,KAA0B,IAA0B;EACnE,IAAIA,KAAK,KAAK,KAAK,EAAE;IACnB,OAAO,SAAS;EAClB;EACA,IAAIA,KAAK,KAAK,IAAI,EAAE;IAClB,OAAO,QAAQ;EACjB;EACA,OAAO,IAAI;AACb,CAAC;AAED,MAAMC,YAAY,GAAGA,CAAA,KAAuB;EAAA,IAAAC,WAAA;EAC1C,MAAMC,OAAO,IAAAD,WAAA,GAAGR,UAAU,CAAC,CAAC,qBAAZQ,WAAA,CAAcE,eAAe;EAC7C,IAAI,CAACD,OAAO,EAAE;IACZb,GAAG,CACD,sIACF,CAAC;IACD;IACA;IACA;IACA,OAAOe,sBAAe;EACxB;EAEA,IAAIC,OAA8B,GAAG,CAAC,CAAC;EACvC,IAAI;IACFA,OAAO,GAAG,CAAAH,OAAO,CAACI,qBAAqB,oBAA7BJ,OAAO,CAACI,qBAAqB,CAAG,CAAC,KAAI,CAAC,CAAC;EACnD,CAAC,CAAC,MAAM;IACN;EAAA;EAGF,MAAMC,iBAAiB,GAAGT,OAAO,CAACO,OAAO,CAACG,SAAS,CAAC;EACpD,MAAMC,iBAAiB,GAAGX,OAAO,CAACO,OAAO,CAACK,SAAS,CAAC;EAEpD,IAAIC,OAAO,GAAG,KAAK;EACnB,IAAI;IACFA,OAAO,GAAG,CAAAT,OAAO,CAACU,0BAA0B,oBAAlCV,OAAO,CAACU,0BAA0B,CAAG,CAAC,MAAK,IAAI;EAC3D,CAAC,CAAC,MAAM;IACND,OAAO,GAAG,KAAK;EACjB;;EAEA;EACA;EACA;EACA,IAAIE,QAAwB,GAAG,IAAI;EACnC,IAAIC,UAAU,GAAG,EAAE;EACnB,IAAIC,MAAM,GAAG,EAAE;EACf,IAAI;IACF,IAAI,OAAOb,OAAO,CAACc,oBAAoB,KAAK,UAAU,EAAE;MACtDH,QAAQ,GAAGX,OAAO,CAACc,oBAAoB,CAAC,CAAC,KAAK,IAAI;IACpD;IACAF,UAAU,GAAG,CAAAZ,OAAO,CAACe,aAAa,oBAArBf,OAAO,CAACe,aAAa,CAAG,CAAC,KAAI,EAAE;IAC5CF,MAAM,GAAG,CAAAb,OAAO,CAACgB,SAAS,oBAAjBhB,OAAO,CAACgB,SAAS,CAAG,CAAC,KAAI,EAAE;EACtC,CAAC,CAAC,MAAM;IACNL,QAAQ,GAAG,IAAI;EACjB;EAEA,IAAIM,cAAc,GAAG,IAAI;EACzB,IAAI;IACFA,cAAc,GAAG,CAAAjB,OAAO,CAACkB,gBAAgB,oBAAxBlB,OAAO,CAACkB,gBAAgB,CAAG,CAAC,MAAK,KAAK;EACzD,CAAC,CAAC,MAAM;IACND,cAAc,GAAG,IAAI;EACvB;;EAEA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACE,MAAME,iBAAiB,GAAGV,OAAO,IAAI,CAACQ,cAAc;EACpD,MAAMG,yBAAyB,GAAGD,iBAAiB,GAAG,SAAS,GAAG,SAAS;EAE3E,MAAMb,SAAuB,GAC3BD,iBAAiB,KAChBM,QAAQ,KAAK,IAAI,GAAG,SAAS,GAAGS,yBAAyB,CAAC;EAE7D,MAAMZ,SAAuB,GAC3BD,iBAAiB,KAChBI,QAAQ,KAAK,IAAI,GAAG,SAAS,GAAG,CAACM,cAAc,GAAG,SAAS,GAAG,SAAS,CAAC;EAE3E9B,GAAG,CACD,mCAAmCgB,OAAO,CAACG,SAAS,IAAI,SAAS,GAAG,GAClE,8BAA8BG,OAAO,mBAAmBQ,cAAc,GAAG,GACzE,UAAUJ,MAAM,IAAI,GAAG,eAAeD,UAAU,IAAI,GAAG,aACrDD,QAAQ,KAAK,IAAI,GAAG,aAAa,GAAGA,QAAQ,EAC5C,IACDA,QAAQ,KAAK,IAAI,IAAIN,iBAAiB,KAAK,IAAI,GAC5C,sCAAsC,GACtC,EAAE,CAAC,GACP,MAAMC,SAAS,EACnB,CAAC;EAED,OAAO;IACLA,SAAS;IACTE,SAAS;IACT;IACA;IACA;IACAa,WAAW,EAAEf;EACf,CAAC;AACH,CAAC;;AAED;AACA;AACA;AACA;AACA,MAAMgB,iBAAiB,GAAIC,OAAmB,IAAW;EACvD,MAAMC,OAAO,GAAGjC,UAAU,CAAC,CAAC;EAC5B,IAAI,CAACiC,OAAO,IAAIA,OAAO,CAACvB,eAAe,IAAI,CAACuB,OAAO,CAACC,YAAY,EAAE;IAChE;EACF;EACA,IAAI;IACFtC,GAAG,CAAC,2DAA2D,CAAC;IAChEqC,OAAO,CAACC,YAAY,CAAC,CAACzC,eAAe,CAAC,EAAG0C,KAAK,IAAK;MACjD,IAAIA,KAAK,EAAE;QACTvC,GAAG,CAAC,uCAAuC,EAAEuC,KAAK,CAAC;QACnD;MACF;MACAvC,GAAG,CAAC,4CAA4C,CAAC;MACjDoC,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;EACJ,CAAC,CAAC,MAAM;IACN;IACA;EAAA;AAEJ,CAAC;AAEM,MAAMI,4BAA4B,GAAGA,CAAA,MAAwB;EAClE1C,IAAI,EAAE,0BAA0B;EAEhC2C,IAAI,EAAE9B,YAAY;EAElB+B,SAASA,CAACC,QAAQ,EAAE;IAClB,MAAMC,OAAO,GAAGA,CAAA,KAAM;MACpB5C,GAAG,CAAC,2DAA2D,CAAC;MAChE2C,QAAQ,CAAChC,YAAY,CAAC,CAAC,CAAC;IAC1B,CAAC;;IAED;IACA;IACA,IAAI,OAAOkC,QAAQ,KAAK,WAAW,EAAE;MACnCA,QAAQ,CAACC,gBAAgB,CAAC,yBAAyB,EAAEF,OAAO,CAAC;IAC/D;IACAT,iBAAiB,CAAC,MAAMQ,QAAQ,CAAChC,YAAY,CAAC,CAAC,CAAC,CAAC;IAEjD,OAAO,MAAM;MACX,IAAI,OAAOkC,QAAQ,KAAK,WAAW,EAAE;QACnCA,QAAQ,CAACE,mBAAmB,CAAC,yBAAyB,EAAEH,OAAO,CAAC;MAClE;IACF,CAAC;EACH;AACF,CAAC,CAAC;AAACpC,OAAA,CAAAgC,4BAAA,GAAAA,4BAAA","ignoreList":[]}

package/dist/cjs/privacy/types.js

@@ -1,34 +0,0 @@
-"use strict";
-
-exports.__esModule = true;
-exports.UNKNOWN_CONSENT = void 0;
-/**
- * Consent vocabulary shared by the gate and every provider.
- *
- * DL #218. Three states, because "we have not been told" is not the same
- * answer as "no" and must not be collapsed into one: a visitor who has not
- * been asked can still be unlocked by their own action, a visitor who
- * refused never can.
- */
-
-/**
- * `necessary` is never gated — auth tokens and the configuration fetch are
- * what make the widget work at all, and a visitor who loaded the page asked
- * for that much. Everything else answers to the gate.
- */
-
-const UNKNOWN_CONSENT = exports.UNKNOWN_CONSENT = Object.freeze({
-  performance: 'unknown',
-  analytics: 'unknown',
-  marketing: 'unknown'
-});
-
-/**
- * A consent provider adapts one host's CMP to the gate.
- *
- * `read()` must answer synchronously with what is known *now*. Providers are
- * installed into an already-rendered storefront page (DL #217), so a provider
- * that only subscribes is inert — the event it waits for may have fired long
- * before the bundle executed. Always read first, then subscribe.
- */
-//# sourceMappingURL=types.js.map

package/dist/cjs/privacy/types.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["UNKNOWN_CONSENT","exports","Object","freeze","performance","analytics","marketing"],"sources":["../../../src/privacy/types.ts"],"sourcesContent":["/**\n * Consent vocabulary shared by the gate and every provider.\n *\n * DL #218. Three states, because \"we have not been told\" is not the same\n * answer as \"no\" and must not be collapsed into one: a visitor who has not\n * been asked can still be unlocked by their own action, a visitor who\n * refused never can.\n */\n\nexport type ConsentState = 'granted' | 'denied' | 'unknown';\n\n/**\n * `necessary` is never gated — auth tokens and the configuration fetch are\n * what make the widget work at all, and a visitor who loaded the page asked\n * for that much. Everything else answers to the gate.\n */\nexport type ConsentPurpose =\n  | 'necessary'\n  | 'performance'\n  | 'analytics'\n  | 'marketing';\n\nexport type GatedPurpose = Exclude<ConsentPurpose, 'necessary'>;\n\nexport type ConsentSnapshot = Record<GatedPurpose, ConsentState>;\n\nexport const UNKNOWN_CONSENT: ConsentSnapshot = Object.freeze({\n  performance: 'unknown',\n  analytics: 'unknown',\n  marketing: 'unknown',\n});\n\n/**\n * A consent provider adapts one host's CMP to the gate.\n *\n * `read()` must answer synchronously with what is known *now*. Providers are\n * installed into an already-rendered storefront page (DL #217), so a provider\n * that only subscribes is inert — the event it waits for may have fired long\n * before the bundle executed. Always read first, then subscribe.\n */\nexport interface ConsentProvider {\n  readonly name: string;\n  read(): ConsentSnapshot;\n  subscribe(onChange: (snapshot: ConsentSnapshot) => void): () => void;\n}\n"],"mappings":";;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAIA;AACA;AACA;AACA;AACA;;AAWO,MAAMA,eAAgC,GAAAC,OAAA,CAAAD,eAAA,GAAGE,MAAM,CAACC,MAAM,CAAC;EAC5DC,WAAW,EAAE,SAAS;EACtBC,SAAS,EAAE,SAAS;EACpBC,SAAS,EAAE;AACb,CAAC,CAAC;;AAEF;AACA;AACA;AACA;AACA;AACA;AACA;AACA","ignoreList":[]}

package/dist/esm/privacy/consentGate.js

@@ -1,122 +0,0 @@
-/**
- * The consent gate — DL #218 (revised).
- *
- * Legal cleared analytics/BI transmission to need no consent gate, so the old
- * `transmit()` + buffer machinery is gone. What analytics emitters used to route
- * through the gate now goes straight to the wire.
- *
- * Analytics AND performance telemetry both go straight to the wire now, so there
- * is nothing left to "transmit"-gate. What remains is the consent SIGNAL —
- * snapshot, engagement, provider — behind a single predicate:
- *
- *   - `mayPersistToken()` — whether the visitor's OAuth token may be written to
- *     localStorage. Persisting the token persists a cross-visit visitor identity
- *     (its refresh token), which is the one thing consent still governs. Truth
- *     table: granted → yes; denied → never; unknown → only once the visitor
- *     engaged.
- *
- * Engagement (`unlockOnUserAction`, fired when the visitor submits a prompt)
- * resolves the `unknown` case — typing a question is a reason to remember this
- * visitor for the session — but it never overrides a `denied`.
- */
-
-import { UNKNOWN_CONSENT } from './types.js';
-const LOG_PREFIX = '[w5-consent]';
-const log = function () {
-  try {
-    for (var _len = arguments.length, args = new Array(_len), _key = 0; _key < _len; _key++) {
-      args[_key] = arguments[_key];
-    }
-    console.debug(LOG_PREFIX, ...args);
-  } catch {
-    // A console that throws must never break anything.
-  }
-};
-const describe = s => `analytics=${s.analytics} performance=${s.performance} marketing=${s.marketing}`;
-let snapshot = UNKNOWN_CONSENT;
-let engaged = false;
-let unsubscribeProvider = null;
-const listeners = new Set();
-const notify = () => {
-  for (const listener of listeners) {
-    try {
-      listener();
-    } catch {
-      // A subscriber that throws must not stop the others.
-    }
-  }
-};
-
-/**
- * Whether the visitor's OAuth token may be persisted to `localStorage`.
- *
- * Persisting the token persists a cross-visit visitor identity (the refresh
- * token re-identifies the visitor on their next visit), so it answers to
- * consent — the one thing that still does. Explicit consent wins in both
- * directions; engagement resolves only the `unknown` case. The token still
- * lives in memory for the session regardless — only the write to storage is
- * gated.
- */
-export const mayPersistToken = () => {
-  const state = snapshot.analytics;
-  if (state === 'denied') {
-    return false;
-  }
-  if (state === 'granted') {
-    return true;
-  }
-  return engaged;
-};
-
-/**
- * The visitor did something deliberate — submitted a prompt — so we may remember
- * them for the session even though no CMP has answered. Unlocks the `unknown`
- * case only; it cannot override a `denied`.
- */
-export const unlockOnUserAction = () => {
-  if (engaged) {
-    return;
-  }
-  engaged = true;
-  log('UNLOCK — visitor submitted a prompt');
-  notify();
-};
-export const getConsentSnapshot = () => snapshot;
-export const subscribeToConsent = listener => {
-  listeners.add(listener);
-  return () => {
-    listeners.delete(listener);
-  };
-};
-const applySnapshot = next => {
-  if (next.analytics === snapshot.analytics && next.marketing === snapshot.marketing && next.performance === snapshot.performance) {
-    return;
-  }
-  log(`ANSWER — ${describe(snapshot)}  →  ${describe(next)}`);
-  snapshot = Object.freeze({
-    ...next
-  });
-  notify();
-};
-
-/**
- * Install the host's provider. Reads its current state immediately, *then*
- * subscribes — DL #217: a listener registered into an already-rendered page is
- * bound to an event that may have fired long before the bundle executed, so
- * subscribing alone would leave the gate permanently at `unknown`.
- */
-export const installConsentProvider = next => {
-  unsubscribeProvider == null || unsubscribeProvider();
-  const initial = next.read();
-  log(`provider installed: ${next.name} — reads ${describe(initial)}`);
-  applySnapshot(initial);
-  unsubscribeProvider = next.subscribe(applySnapshot);
-};
-export const resetConsentGateForTests = () => {
-  unsubscribeProvider == null || unsubscribeProvider();
-  unsubscribeProvider = null;
-  snapshot = UNKNOWN_CONSENT;
-  engaged = false;
-  listeners.clear();
-};
-//# sourceMappingURL=consentGate.js.map

package/dist/esm/privacy/consentGate.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["UNKNOWN_CONSENT","LOG_PREFIX","log","_len","arguments","length","args","Array","_key","console","debug","describe","s","analytics","performance","marketing","snapshot","engaged","unsubscribeProvider","listeners","Set","notify","listener","mayPersistToken","state","unlockOnUserAction","getConsentSnapshot","subscribeToConsent","add","delete","applySnapshot","next","Object","freeze","installConsentProvider","initial","read","name","subscribe","resetConsentGateForTests","clear"],"sources":["../../../src/privacy/consentGate.ts"],"sourcesContent":["/**\n * The consent gate — DL #218 (revised).\n *\n * Legal cleared analytics/BI transmission to need no consent gate, so the old\n * `transmit()` + buffer machinery is gone. What analytics emitters used to route\n * through the gate now goes straight to the wire.\n *\n * Analytics AND performance telemetry both go straight to the wire now, so there\n * is nothing left to \"transmit\"-gate. What remains is the consent SIGNAL —\n * snapshot, engagement, provider — behind a single predicate:\n *\n *   - `mayPersistToken()` — whether the visitor's OAuth token may be written to\n *     localStorage. Persisting the token persists a cross-visit visitor identity\n *     (its refresh token), which is the one thing consent still governs. Truth\n *     table: granted → yes; denied → never; unknown → only once the visitor\n *     engaged.\n *\n * Engagement (`unlockOnUserAction`, fired when the visitor submits a prompt)\n * resolves the `unknown` case — typing a question is a reason to remember this\n * visitor for the session — but it never overrides a `denied`.\n */\n\nimport {\n  UNKNOWN_CONSENT,\n  type ConsentProvider,\n  type ConsentSnapshot,\n} from './types';\n\nconst LOG_PREFIX = '[w5-consent]';\n\nconst log = (...args: unknown[]): void => {\n  try {\n    console.debug(LOG_PREFIX, ...args);\n  } catch {\n    // A console that throws must never break anything.\n  }\n};\n\nconst describe = (s: ConsentSnapshot): string =>\n  `analytics=${s.analytics} performance=${s.performance} marketing=${s.marketing}`;\n\ntype Listener = () => void;\n\nlet snapshot: ConsentSnapshot = UNKNOWN_CONSENT;\nlet engaged = false;\nlet unsubscribeProvider: (() => void) | null = null;\n\nconst listeners = new Set<Listener>();\n\nconst notify = (): void => {\n  for (const listener of listeners) {\n    try {\n      listener();\n    } catch {\n      // A subscriber that throws must not stop the others.\n    }\n  }\n};\n\n/**\n * Whether the visitor's OAuth token may be persisted to `localStorage`.\n *\n * Persisting the token persists a cross-visit visitor identity (the refresh\n * token re-identifies the visitor on their next visit), so it answers to\n * consent — the one thing that still does. Explicit consent wins in both\n * directions; engagement resolves only the `unknown` case. The token still\n * lives in memory for the session regardless — only the write to storage is\n * gated.\n */\nexport const mayPersistToken = (): boolean => {\n  const state = snapshot.analytics;\n  if (state === 'denied') {\n    return false;\n  }\n  if (state === 'granted') {\n    return true;\n  }\n  return engaged;\n};\n\n/**\n * The visitor did something deliberate — submitted a prompt — so we may remember\n * them for the session even though no CMP has answered. Unlocks the `unknown`\n * case only; it cannot override a `denied`.\n */\nexport const unlockOnUserAction = (): void => {\n  if (engaged) {\n    return;\n  }\n  engaged = true;\n  log('UNLOCK — visitor submitted a prompt');\n  notify();\n};\n\nexport const getConsentSnapshot = (): ConsentSnapshot => snapshot;\n\nexport const subscribeToConsent = (listener: Listener): (() => void) => {\n  listeners.add(listener);\n  return () => {\n    listeners.delete(listener);\n  };\n};\n\nconst applySnapshot = (next: ConsentSnapshot): void => {\n  if (\n    next.analytics === snapshot.analytics &&\n    next.marketing === snapshot.marketing &&\n    next.performance === snapshot.performance\n  ) {\n    return;\n  }\n  log(`ANSWER — ${describe(snapshot)}  →  ${describe(next)}`);\n  snapshot = Object.freeze({ ...next });\n  notify();\n};\n\n/**\n * Install the host's provider. Reads its current state immediately, *then*\n * subscribes — DL #217: a listener registered into an already-rendered page is\n * bound to an event that may have fired long before the bundle executed, so\n * subscribing alone would leave the gate permanently at `unknown`.\n */\nexport const installConsentProvider = (next: ConsentProvider): void => {\n  unsubscribeProvider?.();\n  const initial = next.read();\n  log(`provider installed: ${next.name} — reads ${describe(initial)}`);\n  applySnapshot(initial);\n  unsubscribeProvider = next.subscribe(applySnapshot);\n};\n\nexport const resetConsentGateForTests = (): void => {\n  unsubscribeProvider?.();\n  unsubscribeProvider = null;\n  snapshot = UNKNOWN_CONSENT;\n  engaged = false;\n  listeners.clear();\n};\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SACEA,eAAe,QAGV,SAAS;AAEhB,MAAMC,UAAU,GAAG,cAAc;AAEjC,MAAMC,GAAG,GAAG,SAAAA,CAAA,EAA8B;EACxC,IAAI;IAAA,SAAAC,IAAA,GAAAC,SAAA,CAAAC,MAAA,EADUC,IAAI,OAAAC,KAAA,CAAAJ,IAAA,GAAAK,IAAA,MAAAA,IAAA,GAAAL,IAAA,EAAAK,IAAA;MAAJF,IAAI,CAAAE,IAAA,IAAAJ,SAAA,CAAAI,IAAA;IAAA;IAEhBC,OAAO,CAACC,KAAK,CAACT,UAAU,EAAE,GAAGK,IAAI,CAAC;EACpC,CAAC,CAAC,MAAM;IACN;EAAA;AAEJ,CAAC;AAED,MAAMK,QAAQ,GAAIC,CAAkB,IAClC,aAAaA,CAAC,CAACC,SAAS,gBAAgBD,CAAC,CAACE,WAAW,cAAcF,CAAC,CAACG,SAAS,EAAE;AAIlF,IAAIC,QAAyB,GAAGhB,eAAe;AAC/C,IAAIiB,OAAO,GAAG,KAAK;AACnB,IAAIC,mBAAwC,GAAG,IAAI;AAEnD,MAAMC,SAAS,GAAG,IAAIC,GAAG,CAAW,CAAC;AAErC,MAAMC,MAAM,GAAGA,CAAA,KAAY;EACzB,KAAK,MAAMC,QAAQ,IAAIH,SAAS,EAAE;IAChC,IAAI;MACFG,QAAQ,CAAC,CAAC;IACZ,CAAC,CAAC,MAAM;MACN;IAAA;EAEJ;AACF,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,eAAe,GAAGA,CAAA,KAAe;EAC5C,MAAMC,KAAK,GAAGR,QAAQ,CAACH,SAAS;EAChC,IAAIW,KAAK,KAAK,QAAQ,EAAE;IACtB,OAAO,KAAK;EACd;EACA,IAAIA,KAAK,KAAK,SAAS,EAAE;IACvB,OAAO,IAAI;EACb;EACA,OAAOP,OAAO;AAChB,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMQ,kBAAkB,GAAGA,CAAA,KAAY;EAC5C,IAAIR,OAAO,EAAE;IACX;EACF;EACAA,OAAO,GAAG,IAAI;EACdf,GAAG,CAAC,qCAAqC,CAAC;EAC1CmB,MAAM,CAAC,CAAC;AACV,CAAC;AAED,OAAO,MAAMK,kBAAkB,GAAGA,CAAA,KAAuBV,QAAQ;AAEjE,OAAO,MAAMW,kBAAkB,GAAIL,QAAkB,IAAmB;EACtEH,SAAS,CAACS,GAAG,CAACN,QAAQ,CAAC;EACvB,OAAO,MAAM;IACXH,SAAS,CAACU,MAAM,CAACP,QAAQ,CAAC;EAC5B,CAAC;AACH,CAAC;AAED,MAAMQ,aAAa,GAAIC,IAAqB,IAAW;EACrD,IACEA,IAAI,CAAClB,SAAS,KAAKG,QAAQ,CAACH,SAAS,IACrCkB,IAAI,CAAChB,SAAS,KAAKC,QAAQ,CAACD,SAAS,IACrCgB,IAAI,CAACjB,WAAW,KAAKE,QAAQ,CAACF,WAAW,EACzC;IACA;EACF;EACAZ,GAAG,CAAC,YAAYS,QAAQ,CAACK,QAAQ,CAAC,QAAQL,QAAQ,CAACoB,IAAI,CAAC,EAAE,CAAC;EAC3Df,QAAQ,GAAGgB,MAAM,CAACC,MAAM,CAAC;IAAE,GAAGF;EAAK,CAAC,CAAC;EACrCV,MAAM,CAAC,CAAC;AACV,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMa,sBAAsB,GAAIH,IAAqB,IAAW;EACrEb,mBAAmB,YAAnBA,mBAAmB,CAAG,CAAC;EACvB,MAAMiB,OAAO,GAAGJ,IAAI,CAACK,IAAI,CAAC,CAAC;EAC3BlC,GAAG,CAAC,uBAAuB6B,IAAI,CAACM,IAAI,YAAY1B,QAAQ,CAACwB,OAAO,CAAC,EAAE,CAAC;EACpEL,aAAa,CAACK,OAAO,CAAC;EACtBjB,mBAAmB,GAAGa,IAAI,CAACO,SAAS,CAACR,aAAa,CAAC;AACrD,CAAC;AAED,OAAO,MAAMS,wBAAwB,GAAGA,CAAA,KAAY;EAClDrB,mBAAmB,YAAnBA,mBAAmB,CAAG,CAAC;EACvBA,mBAAmB,GAAG,IAAI;EAC1BF,QAAQ,GAAGhB,eAAe;EAC1BiB,OAAO,GAAG,KAAK;EACfE,SAAS,CAACqB,KAAK,CAAC,CAAC;AACnB,CAAC","ignoreList":[]}

package/dist/esm/privacy/consentOverride.js

@@ -1,87 +0,0 @@
-/**
- * Consent override (debug-only) — DL #218.
- *
- * Shopify only serves its cookie banner where consent is legally required, so
- * from most of the world `shouldShowBanner()` is `false` and there is no way to
- * reach the `unknown` or `denied` branches by hand. Development stores often
- * have no privacy configuration at all, which pins the gate at `unknown`
- * forever. Neither is a bug, and both make the interesting states unreachable
- * from a browser.
- *
- * This forces the gate's answer so all four rows of the truth table can be
- * walked on any store, in any region, published or not.
- *
- *   ?w5consent=granted | denied | unknown      (one-shot)
- *   localStorage["w5_consent_override"]        (sticky)
- *
- * **The two are not equally trusted, on purpose.** A link is something one
- * person can send another, so a query param may only ever *reduce* what is
- * collected: `denied` is honoured anywhere, while `granted` and `unknown` are
- * honoured only on a local origin. Turning tracking *on* for someone else by
- * sending them a URL is exactly the thing this whole feature exists to
- * prevent. On a real storefront, set the localStorage key in devtools — which
- * is a deliberate act by the person whose browser it is.
- */
-
-export const CONSENT_OVERRIDE_KEY = 'w5_consent_override';
-export const CONSENT_OVERRIDE_QUERY_PARAM = 'w5consent';
-const VALID = ['granted', 'denied', 'unknown'];
-const isConsentState = value => typeof value === 'string' && VALID.includes(value);
-
-/** Only a local origin may force a *more* permissive state from a URL. */
-const isLocalOrigin = () => {
-  try {
-    const {
-      hostname
-    } = window.location;
-    return hostname === 'localhost' || hostname === '127.0.0.1' || hostname.endsWith('.local');
-  } catch {
-    return false;
-  }
-};
-const readQueryParam = () => {
-  try {
-    const raw = new URLSearchParams(window.location.search).get(CONSENT_OVERRIDE_QUERY_PARAM);
-    if (!isConsentState(raw)) {
-      return null;
-    }
-    // `denied` can only ever collect less, so a link may set it anywhere.
-    if (raw === 'denied' || isLocalOrigin()) {
-      return raw;
-    }
-    console.warn(`[w5-consent] ignoring ?${CONSENT_OVERRIDE_QUERY_PARAM}=${raw} — only "denied" is accepted from a URL off a local origin. ` + `Set localStorage["${CONSENT_OVERRIDE_KEY}"] = "${raw}" instead.`);
-    return null;
-  } catch {
-    return null;
-  }
-};
-const readStorage = () => {
-  try {
-    const raw = localStorage.getItem(CONSENT_OVERRIDE_KEY);
-    return isConsentState(raw) ? raw : null;
-  } catch {
-    return null;
-  }
-};
-
-/** The forced consent state, or `null` when no override is active. */
-export const getConsentOverride = () => readQueryParam() ?? readStorage();
-export const overrideSnapshot = state => ({
-  analytics: state,
-  marketing: state,
-  performance: state
-});
-
-/** Persist the override and apply it on the next load. `null` clears it. */
-export const setConsentOverride = state => {
-  try {
-    if (state) {
-      localStorage.setItem(CONSENT_OVERRIDE_KEY, state);
-    } else {
-      localStorage.removeItem(CONSENT_OVERRIDE_KEY);
-    }
-  } catch {
-    // Ignore — the override simply won't persist.
-  }
-};
-//# sourceMappingURL=consentOverride.js.map

package/dist/esm/privacy/consentOverride.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["CONSENT_OVERRIDE_KEY","CONSENT_OVERRIDE_QUERY_PARAM","VALID","isConsentState","value","includes","isLocalOrigin","hostname","window","location","endsWith","readQueryParam","raw","URLSearchParams","search","get","console","warn","readStorage","localStorage","getItem","getConsentOverride","overrideSnapshot","state","analytics","marketing","performance","setConsentOverride","setItem","removeItem"],"sources":["../../../src/privacy/consentOverride.ts"],"sourcesContent":["/**\n * Consent override (debug-only) — DL #218.\n *\n * Shopify only serves its cookie banner where consent is legally required, so\n * from most of the world `shouldShowBanner()` is `false` and there is no way to\n * reach the `unknown` or `denied` branches by hand. Development stores often\n * have no privacy configuration at all, which pins the gate at `unknown`\n * forever. Neither is a bug, and both make the interesting states unreachable\n * from a browser.\n *\n * This forces the gate's answer so all four rows of the truth table can be\n * walked on any store, in any region, published or not.\n *\n *   ?w5consent=granted | denied | unknown      (one-shot)\n *   localStorage[\"w5_consent_override\"]        (sticky)\n *\n * **The two are not equally trusted, on purpose.** A link is something one\n * person can send another, so a query param may only ever *reduce* what is\n * collected: `denied` is honoured anywhere, while `granted` and `unknown` are\n * honoured only on a local origin. Turning tracking *on* for someone else by\n * sending them a URL is exactly the thing this whole feature exists to\n * prevent. On a real storefront, set the localStorage key in devtools — which\n * is a deliberate act by the person whose browser it is.\n */\n\nimport type { ConsentSnapshot, ConsentState } from './types';\n\nexport const CONSENT_OVERRIDE_KEY = 'w5_consent_override';\nexport const CONSENT_OVERRIDE_QUERY_PARAM = 'w5consent';\n\nconst VALID: readonly ConsentState[] = ['granted', 'denied', 'unknown'];\n\nconst isConsentState = (value: unknown): value is ConsentState =>\n  typeof value === 'string' && (VALID as readonly string[]).includes(value);\n\n/** Only a local origin may force a *more* permissive state from a URL. */\nconst isLocalOrigin = (): boolean => {\n  try {\n    const { hostname } = window.location;\n    return (\n      hostname === 'localhost' ||\n      hostname === '127.0.0.1' ||\n      hostname.endsWith('.local')\n    );\n  } catch {\n    return false;\n  }\n};\n\nconst readQueryParam = (): ConsentState | null => {\n  try {\n    const raw = new URLSearchParams(window.location.search).get(\n      CONSENT_OVERRIDE_QUERY_PARAM,\n    );\n    if (!isConsentState(raw)) {\n      return null;\n    }\n    // `denied` can only ever collect less, so a link may set it anywhere.\n    if (raw === 'denied' || isLocalOrigin()) {\n      return raw;\n    }\n    console.warn(\n      `[w5-consent] ignoring ?${CONSENT_OVERRIDE_QUERY_PARAM}=${raw} — only \"denied\" is accepted from a URL off a local origin. ` +\n        `Set localStorage[\"${CONSENT_OVERRIDE_KEY}\"] = \"${raw}\" instead.`,\n    );\n    return null;\n  } catch {\n    return null;\n  }\n};\n\nconst readStorage = (): ConsentState | null => {\n  try {\n    const raw = localStorage.getItem(CONSENT_OVERRIDE_KEY);\n    return isConsentState(raw) ? raw : null;\n  } catch {\n    return null;\n  }\n};\n\n/** The forced consent state, or `null` when no override is active. */\nexport const getConsentOverride = (): ConsentState | null =>\n  readQueryParam() ?? readStorage();\n\nexport const overrideSnapshot = (state: ConsentState): ConsentSnapshot => ({\n  analytics: state,\n  marketing: state,\n  performance: state,\n});\n\n/** Persist the override and apply it on the next load. `null` clears it. */\nexport const setConsentOverride = (state: ConsentState | null): void => {\n  try {\n    if (state) {\n      localStorage.setItem(CONSENT_OVERRIDE_KEY, state);\n    } else {\n      localStorage.removeItem(CONSENT_OVERRIDE_KEY);\n    }\n  } catch {\n    // Ignore — the override simply won't persist.\n  }\n};\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAIA,OAAO,MAAMA,oBAAoB,GAAG,qBAAqB;AACzD,OAAO,MAAMC,4BAA4B,GAAG,WAAW;AAEvD,MAAMC,KAA8B,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC;AAEvE,MAAMC,cAAc,GAAIC,KAAc,IACpC,OAAOA,KAAK,KAAK,QAAQ,IAAKF,KAAK,CAAuBG,QAAQ,CAACD,KAAK,CAAC;;AAE3E;AACA,MAAME,aAAa,GAAGA,CAAA,KAAe;EACnC,IAAI;IACF,MAAM;MAAEC;IAAS,CAAC,GAAGC,MAAM,CAACC,QAAQ;IACpC,OACEF,QAAQ,KAAK,WAAW,IACxBA,QAAQ,KAAK,WAAW,IACxBA,QAAQ,CAACG,QAAQ,CAAC,QAAQ,CAAC;EAE/B,CAAC,CAAC,MAAM;IACN,OAAO,KAAK;EACd;AACF,CAAC;AAED,MAAMC,cAAc,GAAGA,CAAA,KAA2B;EAChD,IAAI;IACF,MAAMC,GAAG,GAAG,IAAIC,eAAe,CAACL,MAAM,CAACC,QAAQ,CAACK,MAAM,CAAC,CAACC,GAAG,CACzDd,4BACF,CAAC;IACD,IAAI,CAACE,cAAc,CAACS,GAAG,CAAC,EAAE;MACxB,OAAO,IAAI;IACb;IACA;IACA,IAAIA,GAAG,KAAK,QAAQ,IAAIN,aAAa,CAAC,CAAC,EAAE;MACvC,OAAOM,GAAG;IACZ;IACAI,OAAO,CAACC,IAAI,CACV,0BAA0BhB,4BAA4B,IAAIW,GAAG,8DAA8D,GACzH,qBAAqBZ,oBAAoB,SAASY,GAAG,YACzD,CAAC;IACD,OAAO,IAAI;EACb,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;AACF,CAAC;AAED,MAAMM,WAAW,GAAGA,CAAA,KAA2B;EAC7C,IAAI;IACF,MAAMN,GAAG,GAAGO,YAAY,CAACC,OAAO,CAACpB,oBAAoB,CAAC;IACtD,OAAOG,cAAc,CAACS,GAAG,CAAC,GAAGA,GAAG,GAAG,IAAI;EACzC,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;AACF,CAAC;;AAED;AACA,OAAO,MAAMS,kBAAkB,GAAGA,CAAA,KAChCV,cAAc,CAAC,CAAC,IAAIO,WAAW,CAAC,CAAC;AAEnC,OAAO,MAAMI,gBAAgB,GAAIC,KAAmB,KAAuB;EACzEC,SAAS,EAAED,KAAK;EAChBE,SAAS,EAAEF,KAAK;EAChBG,WAAW,EAAEH;AACf,CAAC,CAAC;;AAEF;AACA,OAAO,MAAMI,kBAAkB,GAAIJ,KAA0B,IAAW;EACtE,IAAI;IACF,IAAIA,KAAK,EAAE;MACTJ,YAAY,CAACS,OAAO,CAAC5B,oBAAoB,EAAEuB,KAAK,CAAC;IACnD,CAAC,MAAM;MACLJ,YAAY,CAACU,UAAU,CAAC7B,oBAAoB,CAAC;IAC/C;EACF,CAAC,CAAC,MAAM;IACN;EAAA;AAEJ,CAAC","ignoreList":[]}

package/dist/esm/privacy/detectProvider.js

@@ -1,65 +0,0 @@
-/**
- * Provider selection — DL #218.
- *
- * Detected at boot, not configured per client, because a merchant can install
- * a CMP long after we deploy and the bundle is not the source of truth for a
- * store's behaviour (DL #214).
- *
- * Order is host-supplied → Shopify → OneTrust → none. A host that publishes an
- * answer outranks anything we could sniff, because it knows things we cannot:
- * a server-side consent record, a CMP behind its own abstraction, or a legal
- * position we have no business guessing at.
- *
- * When nothing is detected the gate keeps its default — everything `unknown`,
- * held until the visitor acts. That is the case on every Shopify store with no
- * privacy configuration, which today is most of them.
- */
-
-import { installConsentProvider } from './consentGate.js';
-import { getConsentOverride, overrideSnapshot } from './consentOverride.js';
-import { createHostSuppliedConsentProvider, hasHostSuppliedConsent } from './providers/hostSuppliedProvider.js';
-import { createShopifyConsentProvider, isShopifyHost } from './providers/shopifyProvider.js';
-import { createOneTrustConsentProvider, isOneTrustHost } from './providers/oneTrustProvider.js';
-export const detectConsentProvider = () => {
-  // Debug override outranks every real signal, so the states a region or an
-  // unconfigured store makes unreachable can still be walked by hand.
-  const forced = getConsentOverride();
-  if (forced) {
-    console.warn(`[w5-consent] OVERRIDE ACTIVE — consent forced to "${forced}". This is a debug switch, not a real answer.`);
-    return {
-      name: `override:${forced}`,
-      read: () => overrideSnapshot(forced),
-      subscribe: () => () => {}
-    };
-  }
-  if (hasHostSuppliedConsent()) {
-    return createHostSuppliedConsentProvider();
-  }
-  if (isShopifyHost()) {
-    return createShopifyConsentProvider();
-  }
-  if (isOneTrustHost()) {
-    return createOneTrustConsentProvider();
-  }
-  return null;
-};
-
-/**
- * Install the detected provider, if any. Call once at boot, before the first
- * emitter runs — anything raised earlier is held rather than lost, but the
- * sooner this runs the less the buffer has to carry.
- */
-export const initConsentGate = () => {
-  const provider = detectConsentProvider();
-  if (provider) {
-    installConsentProvider(provider);
-  } else {
-    try {
-      console.debug('[w5-consent] no CMP detected (no host-supplied consent, no Shopify customerPrivacy, no OneTrust) — everything held until the visitor submits a prompt');
-    } catch {
-      /* never break on a console */
-    }
-  }
-  return provider;
-};
-//# sourceMappingURL=detectProvider.js.map

package/dist/esm/privacy/detectProvider.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["installConsentProvider","getConsentOverride","overrideSnapshot","createHostSuppliedConsentProvider","hasHostSuppliedConsent","createShopifyConsentProvider","isShopifyHost","createOneTrustConsentProvider","isOneTrustHost","detectConsentProvider","forced","console","warn","name","read","subscribe","initConsentGate","provider","debug"],"sources":["../../../src/privacy/detectProvider.ts"],"sourcesContent":["/**\n * Provider selection — DL #218.\n *\n * Detected at boot, not configured per client, because a merchant can install\n * a CMP long after we deploy and the bundle is not the source of truth for a\n * store's behaviour (DL #214).\n *\n * Order is host-supplied → Shopify → OneTrust → none. A host that publishes an\n * answer outranks anything we could sniff, because it knows things we cannot:\n * a server-side consent record, a CMP behind its own abstraction, or a legal\n * position we have no business guessing at.\n *\n * When nothing is detected the gate keeps its default — everything `unknown`,\n * held until the visitor acts. That is the case on every Shopify store with no\n * privacy configuration, which today is most of them.\n */\n\nimport { installConsentProvider } from './consentGate';\nimport { getConsentOverride, overrideSnapshot } from './consentOverride';\nimport type { ConsentProvider } from './types';\nimport {\n  createHostSuppliedConsentProvider,\n  hasHostSuppliedConsent,\n} from './providers/hostSuppliedProvider';\nimport {\n  createShopifyConsentProvider,\n  isShopifyHost,\n} from './providers/shopifyProvider';\nimport {\n  createOneTrustConsentProvider,\n  isOneTrustHost,\n} from './providers/oneTrustProvider';\n\nexport const detectConsentProvider = (): ConsentProvider | null => {\n  // Debug override outranks every real signal, so the states a region or an\n  // unconfigured store makes unreachable can still be walked by hand.\n  const forced = getConsentOverride();\n  if (forced) {\n    console.warn(\n      `[w5-consent] OVERRIDE ACTIVE — consent forced to \"${forced}\". This is a debug switch, not a real answer.`,\n    );\n    return {\n      name: `override:${forced}`,\n      read: () => overrideSnapshot(forced),\n      subscribe: () => () => {},\n    };\n  }\n  if (hasHostSuppliedConsent()) {\n    return createHostSuppliedConsentProvider();\n  }\n  if (isShopifyHost()) {\n    return createShopifyConsentProvider();\n  }\n  if (isOneTrustHost()) {\n    return createOneTrustConsentProvider();\n  }\n  return null;\n};\n\n/**\n * Install the detected provider, if any. Call once at boot, before the first\n * emitter runs — anything raised earlier is held rather than lost, but the\n * sooner this runs the less the buffer has to carry.\n */\nexport const initConsentGate = (): ConsentProvider | null => {\n  const provider = detectConsentProvider();\n  if (provider) {\n    installConsentProvider(provider);\n  } else {\n    try {\n      console.debug(\n        '[w5-consent] no CMP detected (no host-supplied consent, no Shopify customerPrivacy, no OneTrust) — everything held until the visitor submits a prompt',\n      );\n    } catch {\n      /* never break on a console */\n    }\n  }\n  return provider;\n};\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,sBAAsB,QAAQ,eAAe;AACtD,SAASC,kBAAkB,EAAEC,gBAAgB,QAAQ,mBAAmB;AAExE,SACEC,iCAAiC,EACjCC,sBAAsB,QACjB,kCAAkC;AACzC,SACEC,4BAA4B,EAC5BC,aAAa,QACR,6BAA6B;AACpC,SACEC,6BAA6B,EAC7BC,cAAc,QACT,8BAA8B;AAErC,OAAO,MAAMC,qBAAqB,GAAGA,CAAA,KAA8B;EACjE;EACA;EACA,MAAMC,MAAM,GAAGT,kBAAkB,CAAC,CAAC;EACnC,IAAIS,MAAM,EAAE;IACVC,OAAO,CAACC,IAAI,CACV,qDAAqDF,MAAM,+CAC7D,CAAC;IACD,OAAO;MACLG,IAAI,EAAE,YAAYH,MAAM,EAAE;MAC1BI,IAAI,EAAEA,CAAA,KAAMZ,gBAAgB,CAACQ,MAAM,CAAC;MACpCK,SAAS,EAAEA,CAAA,KAAM,MAAM,CAAC;IAC1B,CAAC;EACH;EACA,IAAIX,sBAAsB,CAAC,CAAC,EAAE;IAC5B,OAAOD,iCAAiC,CAAC,CAAC;EAC5C;EACA,IAAIG,aAAa,CAAC,CAAC,EAAE;IACnB,OAAOD,4BAA4B,CAAC,CAAC;EACvC;EACA,IAAIG,cAAc,CAAC,CAAC,EAAE;IACpB,OAAOD,6BAA6B,CAAC,CAAC;EACxC;EACA,OAAO,IAAI;AACb,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMS,eAAe,GAAGA,CAAA,KAA8B;EAC3D,MAAMC,QAAQ,GAAGR,qBAAqB,CAAC,CAAC;EACxC,IAAIQ,QAAQ,EAAE;IACZjB,sBAAsB,CAACiB,QAAQ,CAAC;EAClC,CAAC,MAAM;IACL,IAAI;MACFN,OAAO,CAACO,KAAK,CACX,uJACF,CAAC;IACH,CAAC,CAAC,MAAM;MACN;IAAA;EAEJ;EACA,OAAOD,QAAQ;AACjB,CAAC","ignoreList":[]}

package/dist/esm/privacy/index.js

@@ -1,8 +0,0 @@
-export { UNKNOWN_CONSENT } from './types.js';
-export { unlockOnUserAction, mayPersistToken, getConsentSnapshot, subscribeToConsent, installConsentProvider, resetConsentGateForTests } from './consentGate.js';
-export { detectConsentProvider, initConsentGate } from './detectProvider.js';
-export { CONSENT_OVERRIDE_KEY, CONSENT_OVERRIDE_QUERY_PARAM, getConsentOverride, setConsentOverride } from './consentOverride.js';
-export { createShopifyConsentProvider, isShopifyHost } from './providers/shopifyProvider.js';
-export { createOneTrustConsentProvider, isOneTrustHost } from './providers/oneTrustProvider.js';
-export { HOST_CONSENT_GLOBAL, createHostSuppliedConsentProvider, hasHostSuppliedConsent, publishHostConsent } from './providers/hostSuppliedProvider.js';
-//# sourceMappingURL=index.js.map

package/dist/esm/privacy/index.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["UNKNOWN_CONSENT","unlockOnUserAction","mayPersistToken","getConsentSnapshot","subscribeToConsent","installConsentProvider","resetConsentGateForTests","detectConsentProvider","initConsentGate","CONSENT_OVERRIDE_KEY","CONSENT_OVERRIDE_QUERY_PARAM","getConsentOverride","setConsentOverride","createShopifyConsentProvider","isShopifyHost","createOneTrustConsentProvider","isOneTrustHost","HOST_CONSENT_GLOBAL","createHostSuppliedConsentProvider","hasHostSuppliedConsent","publishHostConsent"],"sources":["../../../src/privacy/index.ts"],"sourcesContent":["export {\n  type ConsentState,\n  type ConsentPurpose,\n  type GatedPurpose,\n  type ConsentSnapshot,\n  type ConsentProvider,\n  UNKNOWN_CONSENT,\n} from './types';\n\nexport {\n  unlockOnUserAction,\n  mayPersistToken,\n  getConsentSnapshot,\n  subscribeToConsent,\n  installConsentProvider,\n  resetConsentGateForTests,\n} from './consentGate';\n\nexport { detectConsentProvider, initConsentGate } from './detectProvider';\n\nexport {\n  CONSENT_OVERRIDE_KEY,\n  CONSENT_OVERRIDE_QUERY_PARAM,\n  getConsentOverride,\n  setConsentOverride,\n} from './consentOverride';\n\nexport {\n  createShopifyConsentProvider,\n  isShopifyHost,\n} from './providers/shopifyProvider';\nexport {\n  createOneTrustConsentProvider,\n  isOneTrustHost,\n} from './providers/oneTrustProvider';\nexport {\n  type HostConsentInput,\n  HOST_CONSENT_GLOBAL,\n  createHostSuppliedConsentProvider,\n  hasHostSuppliedConsent,\n  publishHostConsent,\n} from './providers/hostSuppliedProvider';\n"],"mappings":"AAAA,SAMEA,eAAe,QACV,SAAS;AAEhB,SACEC,kBAAkB,EAClBC,eAAe,EACfC,kBAAkB,EAClBC,kBAAkB,EAClBC,sBAAsB,EACtBC,wBAAwB,QACnB,eAAe;AAEtB,SAASC,qBAAqB,EAAEC,eAAe,QAAQ,kBAAkB;AAEzE,SACEC,oBAAoB,EACpBC,4BAA4B,EAC5BC,kBAAkB,EAClBC,kBAAkB,QACb,mBAAmB;AAE1B,SACEC,4BAA4B,EAC5BC,aAAa,QACR,6BAA6B;AACpC,SACEC,6BAA6B,EAC7BC,cAAc,QACT,8BAA8B;AACrC,SAEEC,mBAAmB,EACnBC,iCAAiC,EACjCC,sBAAsB,EACtBC,kBAAkB,QACb,kCAAkC","ignoreList":[]}