universal-ad-loader 0.0.0-stage → 0.1.1

package/dist/ual.min.js

@@ -0,0 +1,12 @@
+(()=>{function ce(){let e={};return{on(r,t){return(e[r]=e[r]||[]).push(t),()=>this.off(r,t)},off(r,t){e[r]=(e[r]||[]).filter(o=>o!==t)},emit(r,t){[...e[r]||[],...e["*"]||[]].forEach(o=>{try{o(t,r)}catch(i){console.error("[UAL] handler error",r,i)}})}}}var de="[UAL]",F=!1;try{F=/[?&]ual_debug=1/.test(location.search)||localStorage.getItem("ual_debug")==="1"}catch(e){}function Y(e){F=!!e}function ue(){return F}function I(...e){F&&console.log(de,...e)}function S(...e){console.warn(de,...e)}function $(e,r={}){return new Promise((t,o)=>{let i=document.querySelector(`script[data-ual-src="${e}"]`);if(i){if(i.dataset.loaded)return t();i.addEventListener("load",()=>t()),i.addEventListener("error",o);return}let a=document.createElement("script");a.async=!0,a.src=e,a.dataset.ualSrc=e,Object.entries(r).forEach(([c,l])=>a.setAttribute(c,l)),a.onload=()=>{a.dataset.loaded="1",t()},a.onerror=()=>o(new Error("Script load failed: "+e)),document.head.appendChild(a)})}function fe(e,r){return e.replace(/\{([\w.]+)\}/g,(t,o)=>{let i=o.split(".").reduce((a,c)=>a==null?void 0:a[c],r);return i==null?"":encodeURIComponent(String(i))})}function q(e){(e||[]).forEach(r=>{if(!r)return;try{if(navigator.sendBeacon&&navigator.sendBeacon(r))return}catch(o){}let t=new Image(1,1);t.src=r})}function R(e,r,t){let o;return Promise.race([e,new Promise(i=>{o=setTimeout(()=>i(t),r)})]).finally(()=>clearTimeout(o))}function W(){return Math.floor(Math.random()*1e10)}function pe(){let e=window.innerWidth||document.documentElement.clientWidth;return e<768?"mobile":e<1024?"tablet":"desktop"}var tt={site:null,consent:{mode:"tcf",timeoutMs:4e3,requiredPurposes:[1]},lazy:{enabled:!0,fetchMargin:"200px"},viewability:{threshold:.5,durationMs:1e3},collapseEmpty:!0,providerTimeoutMs:3e3,targeting:{},providers:{},slots:{},pageRules:[]};async function ge(e){let r=e;if(typeof e=="string"){let t=await fetch(e,{credentials:"omit"});if(!t.ok)throw new Error("Config HTTP "+t.status);r=await t.json()}return we(tt,r||{})}var me=["optional","required","contextual"];function he(e,r){let t=o=>S("Config: "+o);e.site||t('manca "site"');for(let[o,i]of Object.entries(e.providers||{})){if(!i||!i.adapter){t(`provider "${o}" senza "adapter"`);continue}r&&!r.has(i.adapter)&&t(`provider "${o}": adapter "${i.adapter}" non registrato (registralo con registerAdapter prima dell'init)`),i.consent&&!me.includes(i.consent)&&t(`provider "${o}": consent "${i.consent}" non valido (${me.join("|")})`)}for(let[o,i]of Object.entries(e.slots||{})){if(!i||!Array.isArray(i.providers)||!i.providers.length){t(`slot "${o}" senza "providers"`);continue}i.providers.forEach(a=>{let c=typeof a=="string"?a:a&&a.id;(!c||!e.providers[c])&&t(`slot "${o}": provider "${c}" non definito in "providers"`)})}}function we(e,r){let t={...e};for(let o of Object.keys(r)){let i=r[o];t[o]=i&&typeof i=="object"&&!Array.isArray(i)&&e[o]&&typeof e[o]=="object"&&!Array.isArray(e[o])?we(e[o],i):i}return t}function ye(e,r=location.pathname){let t={...e,slots:JSON.parse(JSON.stringify(e.slots)),targeting:{...e.targeting}};for(let o of e.pageRules||[]){let i;try{i=new RegExp(o.match)}catch(a){S("pageRule regex non valida",o.match);continue}i.test(r)&&((o.disable||[]).forEach(a=>{t.slots[a]&&(t.slots[a].enabled=!1)}),(o.enable||[]).forEach(a=>{t.slots[a]&&(t.slots[a].enabled=!0)}),Object.assign(t.targeting,o.targeting||{}),Object.entries(o.slots||{}).forEach(([a,c])=>{t.slots[a]={...t.slots[a],...c}}))}return t}function ve(e){let r=window.innerWidth||document.documentElement.clientWidth;if(Array.isArray(e.sizeMapping)&&e.sizeMapping.length){let t=[...e.sizeMapping].sort((o,i)=>i.minWidth-o.minWidth).find(o=>r>=o.minWidth);return t?t.sizes:[]}return e.sizes||[]}function be(e){return new Promise(r=>{if(typeof window.__tcfapi=="function")return r(!0);let t=Date.now(),o=setInterval(()=>{typeof window.__tcfapi=="function"?(clearInterval(o),r(!0)):Date.now()-t>e&&(clearInterval(o),r(!1))},50)})}function Se(e,r){window.__tcfapi("addEventListener",2,(t,o)=>{!o||!t||(t.gdprApplies===!1||t.eventStatus==="tcloaded"||t.eventStatus==="useractioncomplete")&&r(nt(t,e))})}var Ee=Symbol("timeout");async function Ae(e={},r){let t={mode:"tcf",timeoutMs:4e3,cmpWaitMs:1500,lateWatchMs:3e4,requiredPurposes:[1],vendorId:null,...e};if(t.mode==="none")return{gdprApplies:!1,tcString:"",purposes:{},granted:!0,source:"none"};if(!await be(t.cmpWaitMs))return I("Nessuna CMP TCF trovata (continuo a cercarla)"),r&&be(t.lateWatchMs).then(l=>{l&&Se(t,r)}),{gdprApplies:void 0,tcString:"",purposes:{},granted:!1,source:"no-cmp"};let i=!1,a=new Promise(l=>{Se(t,u=>{i?r&&r(u):(i=!0,l(u))})}),c=await R(a,t.timeoutMs,Ee);return i=!0,c===Ee?{gdprApplies:!0,tcString:"",purposes:{},granted:!1,source:"timeout"}:c}function nt(e,r){let t=e.purpose&&e.purpose.consents||{},o=e.vendor&&e.vendor.consents||{},i=e.gdprApplies===!1||r.requiredPurposes.every(c=>t[c]===!0);i&&e.gdprApplies!==!1&&r.vendorId&&(i=o[r.vendorId]===!0);let a={gdprApplies:e.gdprApplies,tcString:e.tcString||"",purposes:t,vendorConsents:o,granted:i,source:"tcf"};return I("Consenso",a.granted?"OK":"limitato",a),a}var xe="allow-scripts allow-popups allow-popups-to-escape-sandbox",B=2e3,rt=0,te=new Map;function Te(e){let r=Math.round(Number(e));return r>0&&r<=B?r:0}function H(e,r){if(typeof e!="string"||!e)return null;try{let t=new URL(e,location.href);if(t.protocol==="http:"||t.protocol==="https:"||r&&t.protocol==="data:"&&/^data:image\//i.test(t.href))return t.href}catch(t){}return null}function Z(e){return(Array.isArray(e)?e:[]).map(r=>H(r)).filter(Boolean)}function ze(e){if(!e||typeof e!="object")return{ok:!1,reason:"annuncio non valido"};let r=e.type||(e.url?"url":e.src?"image":"html"),t=Te(e.width),o=Te(e.height);if(!t||!o)return{ok:!1,reason:`dimensioni non valide (${e.width}x${e.height}, max ${B})`};let i=e.trackers||{},a={type:r,width:t,height:o,alt:e.alt==null?void 0:String(e.alt),clickUrl:H(e.clickUrl)||"",trackers:{impression:Z(i.impression),viewable:Z(i.viewable),click:Z(i.click)},sandbox:typeof e.sandbox=="string"?e.sandbox:void 0};if(r==="image"){if(a.src=H(e.src,!0),!a.src)return{ok:!1,reason:"src immagine non valido (ammessi http, https, data:image)"}}else if(r==="url"){if(a.url=H(e.url),!a.url)return{ok:!1,reason:"url non valido (ammessi solo http e https)"}}else if(r==="html"){if(typeof e.html!="string"||!e.html)return{ok:!1,reason:"html mancante"};a.html=e.html}else return{ok:!1,reason:"tipo sconosciuto: "+r};return{ok:!0,ad:a}}function Ie(e){return String(e).split(/\s+/).filter(Boolean)}function it(e){let r=e.sandbox&&e.sandbox!=="none"?e.sandbox:null;if(e.type==="url"){let t=!0;try{t=new URL(e.url).origin===location.origin}catch(o){}return e.sandbox==="none"&&!t?null:Ie(r||xe+" allow-same-origin").filter(o=>o!=="allow-top-navigation"&&!(t&&o==="allow-same-origin")).join(" ")}return Ie(r||xe).filter(t=>t!=="allow-top-navigation"&&t!=="allow-same-origin").join(" ")}function ke(e){return JSON.stringify(String(e)).replace(/</g,"\\u003c").replace(/>/g,"\\u003e").replace(/\u2028/g,"\\u2028").replace(/\u2029/g,"\\u2029")}function ot(e,r){return`<script>(function(){
+var C=${ke(e)};
+function s(m){m.ual=C;parent.postMessage(m,'*');}
+window.clickTag=${ke(r||"")};
+window.UALExt={
+  resize:function(w,h){s({cmd:'resize',w:w,h:h});},
+  expand:function(w,h){s({cmd:'resize',w:w,h:h,expanded:true});},
+  collapse:function(){s({cmd:'collapse'});},
+  close:function(){s({cmd:'close'});},
+  click:function(){s({cmd:'click'});if(window.clickTag)window.open(window.clickTag,'_blank');}
+};
+})();<\/script>`}function ee(e){return String(e).replace(/&/g,"&amp;").replace(/"/g,"&quot;").replace(/</g,"&lt;").replace(/>/g,"&gt;")}function st(e,r){let t='<!doctype html><html><head><meta charset="utf-8"><base target="_blank"><style>html,body{margin:0;padding:0;overflow:hidden;background:transparent}img{display:block;border:0;max-width:100%}</style>'+ot(r,e.clickUrl)+"</head><body>",o="";if(e.type==="image"){let i=`<img src="${ee(e.src)}" width="${e.width}" height="${e.height}" alt="${ee(e.alt||"Advertisement")}">`;o=e.clickUrl?`<a href="${ee(e.clickUrl)}" rel="noopener sponsored" onclick="parent.postMessage({ual:'${r}',cmd:'click'},'*')">${i}</a>`:i}else o=e.html||"";return t+o+"</body></html>"}function Ce(e,r,{slotId:t,onClick:o,onClose:i}={}){at();let a="ual"+ ++rt,c=document.createElement("iframe");c.title="Advertisement",c.setAttribute("scrolling","no"),c.setAttribute("frameborder","0"),c.setAttribute("loading","eager"),c.setAttribute("referrerpolicy","strict-origin-when-cross-origin"),c.style.cssText=`border:0;display:block;margin:0 auto;width:${r.width}px;height:${r.height}px;max-width:100%`,c.width=r.width,c.height=r.height;let l=it(r);return l!==null&&c.setAttribute("sandbox",l),r.type==="url"?c.src=r.url:c.srcdoc=st(r,a),te.set(a,{iframe:c,slotId:t,ad:r,original:{w:r.width,h:r.height},onClick:()=>{q(r.trackers&&r.trackers.click),o&&o()},onClose:i}),e.innerHTML="",e.appendChild(c),{iframe:c,channel:a,destroy:()=>te.delete(a)}}var Me=!1;function at(){Me||(Me=!0,window.addEventListener("message",lt))}function lt(e){let r=e.data;if(!r||typeof r!="object"||!r.ual)return;let t=te.get(r.ual);if(!(!t||e.source!==t.iframe.contentWindow))switch(r.cmd){case"resize":{let o=Math.min(+r.w||t.original.w,B),i=Math.min(+r.h||t.original.h,B);t.iframe.style.width=o+"px",t.iframe.style.height=i+"px";break}case"collapse":t.iframe.style.width=t.original.w+"px",t.iframe.style.height=t.original.h+"px";break;case"close":t.onClose&&t.onClose();break;case"click":t.onClick();break;default:}}function Oe(e,{threshold:r=.5,durationMs:t=1e3}={},o){if(!("IntersectionObserver"in window))return()=>{};let i=null,a=!1,c=!1,l=()=>{a||i||document.visibilityState!=="visible"||(i=setTimeout(()=>{a=!0,E(),o()},t))},u=()=>{clearTimeout(i),i=null},f=new IntersectionObserver(A=>{A.forEach(p=>{c=p.intersectionRatio>=r,c?l():u()})},{threshold:[0,r,1]}),y=()=>document.visibilityState==="visible"&&c?l():u();document.addEventListener("visibilitychange",y),f.observe(e);function E(){u(),f.disconnect(),document.removeEventListener("visibilitychange",y)}return E}var ct=new Set(["unconfigured","disabled","closed"]),dt=242500;function $e(e){let r=ce(),t=null,o=null,i={},a={gdprApplies:void 0,tcString:"",purposes:{},granted:!1,source:"pending"},c=Promise.resolve(a),l=!1,u=null,f=new Map,y=new Map,E=0,A=null,p=null,v=new Set,M=null;function z(){return{site:t.site,page:{url:location.href,path:location.pathname,ref:document.referrer,title:document.title},device:pe(),viewport:{w:window.innerWidth,h:window.innerHeight},targeting:{...t.targeting},consent:a,debug:ue()}}function k(){let n=ye(o);return Object.assign(n.targeting,i),n}function _(n){let s=a;if(!(s.granted===n.granted&&s.tcString===n.tcString&&s.source===n.source)&&(a=n,r.emit("consent",a),!s.granted&&n.granted))for(let d of[...f.values()])d.consentSkipped&&U(d)}function U(n,s=20){if(f.get(n.instanceId)===n){if(n.status==="loading"||n.status==="queued"){s>0&&setTimeout(()=>U(n,s-1),250);return}K(n)}}function We(n){return u?(S("init gi\xE0 eseguito"),u):(u=He(n).catch(s=>{throw u=null,s}),u)}async function He(n){o=await ge(n),o.debug&&Y(!0),he(o,e),t=k(),I("Config",t),c=Ae(t.consent,_).then(s=>(_(s),s)),document.readyState==="loading"&&await new Promise(s=>document.addEventListener("DOMContentLoaded",s,{once:!0})),l=!0,Xe(),V(document),Je(),r.emit("ready",{site:t.site})}function V(n){let s=[];n.nodeType===1&&n.matches&&n.matches("[data-ad-slot]")&&s.push(n),n.querySelectorAll&&n.querySelectorAll("[data-ad-slot]").forEach(d=>s.push(d)),s.forEach(Be)}function Be(n){let s=n.dataset.ualId;if(!s)return oe(n);f.has(s)||ct.has(n.dataset.ualStatus)||(ie(n),oe(n))}function ie(n){delete n.dataset.ualId,delete n.dataset.ualStatus,n.querySelectorAll(":scope > .ual-label, :scope > .ual-creative").forEach(s=>s.remove()),n.classList.remove("ual-slot","ual-filled"),n.style.display="",n.style.minHeight=""}function oe(n){let s=n.getAttribute("data-ad-slot"),d=t.slots[s];if(n.dataset.ualId=s+"#"+ ++E,!d){I("Slot non configurato, ignorato:",s),n.dataset.ualStatus="unconfigured";return}if(d.enabled===!1){I("Slot disabilitato:",s),n.dataset.ualStatus="disabled",X(n,d);return}let w={};try{w=n.dataset.adParams?JSON.parse(n.dataset.adParams):{}}catch(T){S("data-ad-params non \xE8 JSON valido",n)}let h={instanceId:n.dataset.ualId,name:s,el:n,cfg:d,params:w,status:"idle",cleanup:[],tries:0,consentSkipped:!1};f.set(h.instanceId,h),Ve(h),r.emit("slotRegistered",C(h)),(d.lazy!==void 0?d.lazy:t.lazy.enabled)&&A?A.observe(n):J(h)}function Ve(n){let{el:s,cfg:d}=n;if(d.minHeight&&(s.style.minHeight=d.minHeight+"px"),s.classList.add("ual-slot"),d.label){let h=document.createElement("div");h.className="ual-label",h.textContent=d.label,h.style.cssText="font:10px/1.4 sans-serif;color:#888;text-align:center;text-transform:uppercase;letter-spacing:.05em",s.appendChild(h)}let w=document.createElement("div");w.className="ual-creative",s.appendChild(w),n.box=w}function Je(){"MutationObserver"in window&&(p=new MutationObserver(n=>{for(let s of n)s.removedNodes.forEach(d=>{if(d.nodeType===1)for(let w of[...f.values()])(d===w.el||d.contains(w.el))&&G(w)}),s.addedNodes.forEach(d=>{d.nodeType===1&&V(d)})}),p.observe(document.body||document.documentElement,{childList:!0,subtree:!0}))}function Xe(){"IntersectionObserver"in window&&(A=new IntersectionObserver(n=>{n.forEach(s=>{if(!s.isIntersecting)return;A.unobserve(s.target);let d=f.get(s.target.dataset.ualId);d&&J(d)})},{rootMargin:t.lazy.fetchMargin}))}function J(n){n.status!=="loading"&&(n.status="queued",v.add(n),clearTimeout(M),M=setTimeout(Ke,30))}function Ke(){let n=[...v];v=new Set,n.length&&se(n,0)}async function se(n,s){let d=new Map,w=[];for(let h of n){let b=(h.cfg.providers||[])[s];if(!b){w.push(h);continue}let T=typeof b=="string"?b:b.id;d.has(T)||d.set(T,[]),d.get(T).push(h)}w.forEach(Ye),await Promise.all([...d.entries()].map(async([h,b])=>{let T=await Qe(h,b,s);T.length&&await se(T,s+1)}))}async function Ge(n){let s=t.providers[n];if(!s)throw new Error("Provider non definito: "+n);let d=e.get(s.adapter);if(!d)throw new Error("Adapter non registrato: "+s.adapter);return y.has(n)||y.set(n,Promise.resolve(d.init?d.init(s,z()):null)),await y.get(n),{adapter:d,pcfg:s}}async function Qe(n,s,d){let w=t.providers[n];if((!w||w.consent!=="contextual")&&await c,s=s.filter(m=>f.get(m.instanceId)===m),!s.length)return[];let h,b;try{({adapter:h,pcfg:b}=await Ge(n))}catch(m){return S(m.message),r.emit("error",{provider:n,error:m}),s}if(b.consent==="required"&&!a.granted)return I(`Provider ${n} saltato: consenso non concesso`),s.forEach(m=>{m.consentSkipped=!0}),s;let T=z(),O=s.map(m=>{m.status="loading",m.provider=n;let g=m.cfg.providers[d];return{id:m.instanceId,name:m.name,el:m.box,sizes:ve(m.cfg),params:{...typeof g=="object"?g.params:{},...m.params},cfg:m.cfg}});O.forEach(m=>r.emit("slotRequested",{slot:m.name,id:m.id,provider:n})),I(`Richiesta a ${n} (${b.adapter})`,O.map(m=>m.name));let le=b.timeoutMs||t.providerTimeoutMs,L=[];try{if(h.fill){let m=await R(h.fill(O,b,T),le+2e3,{});s.forEach((g,Q)=>{let x=m[O[Q].id];x&&x.filled?ae(g,{width:x.width,height:x.height,selfRendered:!0,meta:x.meta}):(N(g),P(g),L.push(g))})}else{let m=await R(h.request(O,b,T),le,{});s.forEach((g,Q)=>{let x=m[O[Q].id];if(!x||!x.html&&!x.src&&!x.url){L.push(g);return}let D=ze(x);if(!D.ok){S(`Annuncio scartato (${n}, slot ${g.name}): ${D.reason}`),r.emit("error",{provider:n,slot:g.name,error:new Error(D.reason)}),L.push(g);return}let j=D.ad,et=Ce(g.box,j,{slotId:g.instanceId,onClick:()=>r.emit("slotClick",C(g)),onClose:()=>{G(g),g.el.dataset.ualStatus="closed",X(g.el,g.cfg,!0)}});g.cleanup.push(et.destroy),q(j.trackers.impression),ae(g,{width:j.width,height:j.height,ad:j})})}}catch(m){S(`Errore provider ${n}`,m),r.emit("error",{provider:n,error:m}),s.forEach(g=>{g.status==="loading"&&(N(g),P(g),L.push(g))})}return L}function ae(n,s){n.status="filled",n.el.dataset.ualStatus="filled",n.el.classList.add("ual-filled"),n.el.style.display="",r.emit("slotRendered",{...C(n),width:s.width,height:s.height,meta:s.meta});let d={...t.viewability,...n.cfg.viewability};(s.width||0)*(s.height||0)>dt&&!(n.cfg.viewability&&n.cfg.viewability.threshold!==void 0)&&(d.threshold=Math.min(d.threshold,.3));let h=n.box.firstElementChild||n.box,b=Oe(h,d,()=>{s.ad&&q(s.ad.trackers.viewable),r.emit("slotViewable",C(n)),Ze(n)});n.cleanup.push(b)}function Ye(n){n.status="empty",n.el.dataset.ualStatus="empty",P(n),X(n.el,n.cfg),r.emit("slotEmpty",C(n))}function X(n,s,d){(d||(s.collapseEmpty!==void 0?s.collapseEmpty:t&&t.collapseEmpty))&&(n.style.display="none",n.style.minHeight="")}function P(n){n.cleanup.forEach(s=>{try{s()}catch(d){}}),n.cleanup=[],n.box&&(n.box.innerHTML="")}function N(n){let s=n.provider&&t.providers[n.provider],d=s&&e.get(s.adapter);if(d&&d.destroy)try{d.destroy({id:n.instanceId,el:n.box},s)}catch(w){}}function Ze(n){let s=n.cfg.refreshSec;if(!s||n.cfg.maxRefresh&&n.tries>=n.cfg.maxRefresh)return;let d=()=>{n.refreshTimer=setTimeout(()=>{if(!f.has(n.instanceId))return;let w=n.el.getBoundingClientRect();w.bottom>0&&w.top<window.innerHeight&&document.visibilityState==="visible"?(n.tries++,K(n)):d()},s*1e3)};d(),n.cleanup.push(()=>clearTimeout(n.refreshTimer))}function K(n){n.status==="loading"||n.status==="queued"||(N(n),P(n),n.status="idle",n.consentSkipped=!1,J(n))}function G(n){N(n),P(n),A&&A.unobserve(n.el),f.delete(n.instanceId)}function C(n){return{slot:n.name,id:n.instanceId,provider:n.provider,status:n.status,el:n.el}}return{init:We,isInitialized:()=>u!==null,whenReady:()=>u,on:r.on.bind(r),off:r.off.bind(r),registerAdapter:(n,s)=>e.set(n,s),setTargeting(n){Object.entries(n||{}).forEach(([s,d])=>{d==null?(delete i[s],t&&delete t.targeting[s]):(i[s]=d,t&&(t.targeting[s]=d))})},refresh(n){for(let s of f.values())(!n||n.includes(s.name))&&K(s)},pageView(){if(l){for(let n of[...f.values()])G(n);document.querySelectorAll("[data-ual-id]").forEach(ie),t=k(),V(document)}},getSlots:()=>[...f.values()].map(C),getConsent:()=>a,debug:Y}}var Pe={name:"json",async request(e,r,t){let o={site:t.site,page:t.page,device:t.device,viewport:t.viewport,targeting:t.targeting,consent:{gdprApplies:t.consent.gdprApplies,tcString:t.consent.tcString,granted:t.consent.granted},slots:e.map(l=>({id:l.id,name:l.name,sizes:l.sizes,params:l.params}))},i=await fetch(r.endpoint,{method:"POST",headers:{"Content-Type":"application/json",...r.headers},body:JSON.stringify(o),credentials:r.withCredentials&&t.consent.granted?"include":"omit",keepalive:!1});if(i.status===204)return{};if(!i.ok)throw new Error("decide HTTP "+i.status);let a=await i.json();r.map&&typeof window[r.map]=="function"&&(a=window[r.map](a,e));let c={};return(a.ads||[]).forEach(l=>{l&&l.slotId&&(c[l.slotId]=l)}),c}};var Le={name:"iframe",async request(e,r,t){let o={};return e.forEach(i=>{let[a,c]=i.sizes&&i.sizes[0]||[i.params.width||300,i.params.height||250],l=fe(r.url,{params:i.params,width:a,height:c,site:t.site,slot:i.name,device:t.device,cb:W(),page:t.page,consent:{tcString:t.consent.tcString,gdpr:t.consent.gdprApplies?1:0}});o[i.id]={type:"url",url:l,width:a,height:c,sandbox:r.sandbox||void 0}}),o}};function je(e){return e.server.replace(/\/$/,"")+(e.deliveryPath||"/www/delivery")}var qe={name:"revive",async request(e,r,t){let o={};return e.forEach(i=>{if(i.params.zoneid==null){S(`revive: zoneid mancante per lo slot "${i.name}", slot saltato`);return}let[a,c]=i.sizes&&i.sizes[0]||[300,250],l=new URLSearchParams({zoneid:i.params.zoneid,cb:W()});t.page.ref&&l.set("referer",t.page.ref),Object.entries(i.params.vars||{}).forEach(([u,f])=>l.set(u,f)),o[i.id]={type:"url",url:`${je(r)}/afr.php?${l}`,width:a,height:c}}),o}},Re={name:"revive-async",async fill(e,r){let t={},o=`${je(r)}/asyncjs.php`,i=e.filter(l=>l.params.zoneid!=null?!0:(S(`revive-async: zoneid mancante per lo slot "${l.name}", slot saltato`),t[l.id]={filled:!1},!1));if(!i.length)return t;let a=i.map(l=>{let u=document.createElement("ins");return u.setAttribute("data-revive-zoneid",l.params.zoneid),u.setAttribute("data-revive-id",r.reviveId),Object.entries(l.params.vars||{}).forEach(([f,y])=>u.setAttribute("data-revive-"+f,y)),l.el.appendChild(u),new Promise(f=>{let y=p=>{E.disconnect(),clearTimeout(A);let v=u.getBoundingClientRect();t[l.id]={filled:p,width:Math.round(v.width),height:Math.round(v.height)},f()},E=new MutationObserver(()=>{u.querySelector("img,iframe,a,div,embed")&&y(!0)});E.observe(u,{childList:!0,subtree:!0});let A=setTimeout(()=>y(u.children.length>0),r.fillTimeoutMs||2500)})}),c=window.reviveAsync&&window.reviveAsync[r.reviveId];return c&&typeof c.refresh=="function"?c.refresh():await $(o),await Promise.all(a),t}};var ut=0,ne=new Map;function ft(e,r){return e.replace(/\{([\w.]+)\}/g,(t,o)=>{let i=o.split(".").reduce((a,c)=>a==null?void 0:a[c],r);return i==null?"":String(i)})}var re=new Set;function pt(e,r){let t=r||{};re.forEach(o=>{if(!(o in t)){try{e.clearTargeting(o)}catch(i){}re.delete(o)}}),Object.entries(t).forEach(([o,i])=>{e.setTargeting(o,i),re.add(o)})}var _e={name:"gpt",async init(e,r){window.googletag=window.googletag||{cmd:[]};let t=window.googletag;t.cmd.push(()=>{let o=t.pubads();e.singleRequest!==!1&&o.enableSingleRequest(),o.disableInitialLoad(),o.collapseEmptyDivs(!1),e.nonPersonalizedWithoutConsent&&r.consent&&!r.consent.granted&&o.setPrivacySettings&&o.setPrivacySettings({nonPersonalizedAds:!0}),t.enableServices()}),await $(e.src||"https://securepubads.g.doubleclick.net/tag/js/gpt.js",{crossorigin:"anonymous"})},fill(e,r,t){return new Promise(o=>{let i=window.googletag,a={},c=e.length;i.cmd.push(()=>{let l=i.pubads();pt(l,t.targeting);let u=[],f={};if(e.forEach(p=>{let v=document.createElement("div");v.id="ual-gpt-"+ ++ut,p.el.appendChild(v);let M=p.params.adUnitPath||ft(r.adUnitPath,{network:r.network,site:t.site,slot:p.name,section:p.params.section,params:p.params}),z=p.sizes.length?p.sizes:["fluid"],k=i.defineSlot(M,z,v.id);if(!k){a[p.id]={filled:!1},c--;return}k.addService(l),Object.entries(p.params.targeting||{}).forEach(([_,U])=>k.setTargeting(_,U)),ne.set(p.id,k),f[v.id]=p.id,u.push(k),i.display(v.id)}),!c)return o(a);let y,E=()=>{clearTimeout(y),l.removeEventListener("slotRenderEnded",A),Object.values(f).forEach(p=>{a[p]||(a[p]={filled:!1})}),o(a)},A=p=>{let v=f[p.slot.getSlotElementId()];if(!v||a[v])return;let[M,z]=Array.isArray(p.size)?p.size:[0,0];a[v]={filled:!p.isEmpty,width:M,height:z,meta:{advertiserId:p.advertiserId,lineItemId:p.lineItemId,creativeId:p.creativeId}},--c===0&&E()};l.addEventListener("slotRenderEnded",A),y=setTimeout(E,r.fillTimeoutMs||4e3),l.refresh(u)})})},destroy(e){let r=ne.get(e.id);r&&window.googletag&&window.googletag.destroySlots&&(window.googletag.destroySlots([r]),ne.delete(e.id))}};var Ue={name:"adsense",async init(e){await $(`https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=${encodeURIComponent(e.client)}`,{crossorigin:"anonymous"})},fill(e,r){return Promise.all(e.map(t=>new Promise(o=>{let i=document.createElement("ins");i.className="adsbygoogle",i.setAttribute("data-ad-client",r.client),i.setAttribute("data-ad-slot",t.params.slot);let[a,c]=t.sizes[0]||[];t.params.format||!a?(i.style.display="block",i.setAttribute("data-ad-format",t.params.format||"auto"),t.params.responsive!==!1&&i.setAttribute("data-full-width-responsive","true")):i.style.cssText=`display:inline-block;width:${a}px;height:${c}px`,r.test&&i.setAttribute("data-adtest","on"),t.el.appendChild(i);let l=y=>{u.disconnect(),clearTimeout(f);let E=i.getBoundingClientRect();o([t.id,{filled:y,width:Math.round(E.width),height:Math.round(E.height)}])},u=new MutationObserver(()=>{let y=i.getAttribute("data-ad-status");y==="filled"?l(!0):y==="unfilled"&&l(!1)});u.observe(i,{attributes:!0,attributeFilter:["data-ad-status"]});let f=setTimeout(()=>l(!!i.querySelector("iframe")),r.fillTimeoutMs||4e3);try{(window.adsbygoogle=window.adsbygoogle||[]).push({})}catch(y){l(!1)}}))).then(t=>Object.fromEntries(t))}};function mt(e){let r=e.reduce((o,i)=>o+(i.weight||1),0),t=Math.random()*r;for(let o of e)if(t-=o.weight||1,t<=0)return o;return e[e.length-1]}var Ne={name:"house",async request(e,r,t){let o=Date.now(),i={};return e.forEach(a=>{let c=(r.creatives||[]).filter(l=>!(l.slots&&!l.slots.includes(a.name)||l.devices&&!l.devices.includes(t.device)||l.from&&o<Date.parse(l.from)||l.to&&o>Date.parse(l.to)+864e5||a.sizes.length&&!a.sizes.some(([u,f])=>u===l.width&&f===l.height)));if(c.length){let l=mt(c);i[a.id]={...l,type:l.type||(l.html?"html":"image")}}}),i}};var gt="0.1.1";function De(){let e=new Map(Object.entries({json:Pe,iframe:Le,revive:qe,"revive-async":Re,gpt:_e,adsense:Ue,house:Ne}));return{...$e(e),version:gt}}var Fe="ual";(function(){let r=window[Fe]||{};if(r.version)return;let o={...De(),cmd:{push:u=>i(u)}};function i(u){try{u(o)}catch(f){S("Errore in comando cmd",f)}}let a=Array.isArray(r.cmd)?r.cmd:[];window[Fe]=o;let c=document.currentScript||document.querySelector('script[data-ual-config],script[data-config][src*="ual"]'),l=c&&(c.getAttribute("data-ual-config")||c.getAttribute("data-config"));if(a.forEach(i),l){let u=()=>o.init(l).catch(f=>S("Init fallito",f));document.readyState==="loading"?document.addEventListener("DOMContentLoaded",u):u()}})();})();

package/dist/vue.cjs

@@ -0,0 +1,128 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/vue.js
+var vue_exports = {};
+__export(vue_exports, {
+  AdSlot: () => AdSlot,
+  UalProvider: () => UalProvider,
+  useUal: () => useUal
+});
+module.exports = __toCommonJS(vue_exports);
+var import_vue = require("vue");
+
+// src/wrappers/start.js
+var import_lib = require("./index.cjs");
+var loading = /* @__PURE__ */ new Map();
+function loadFromCdn(src) {
+  if (window.ual && window.ual.version) return Promise.resolve(window.ual);
+  if (!loading.has(src)) {
+    loading.set(src, new Promise((resolve, reject) => {
+      const s = document.createElement("script");
+      s.async = true;
+      s.src = src;
+      s.onload = () => {
+        if (window.ual && window.ual.version) resolve(window.ual);
+        else reject(new Error("il loader caricato da " + src + " non ha esposto window.ual"));
+      };
+      s.onerror = () => {
+        loading.delete(src);
+        reject(new Error("impossibile caricare il loader da " + src));
+      };
+      document.head.appendChild(s);
+    }));
+  }
+  return loading.get(src);
+}
+async function startUal({ config, src, beforeInit }) {
+  const ual = src ? await loadFromCdn(src) : (0, import_lib.getUal)();
+  if (beforeInit) beforeInit(ual);
+  const started = typeof ual.isInitialized === "function" && ual.isInitialized();
+  if (started) {
+    const p = typeof ual.whenReady === "function" ? ual.whenReady() : null;
+    if (p) await p;
+  } else {
+    await ual.init(config);
+  }
+  return ual;
+}
+
+// src/vue.js
+var KEY = /* @__PURE__ */ Symbol("ual");
+function useUal() {
+  return (0, import_vue.inject)(KEY, { ual: (0, import_vue.shallowRef)(null), ready: (0, import_vue.ref)(false) });
+}
+var UalProvider = (0, import_vue.defineComponent)({
+  name: "UalProvider",
+  props: {
+    config: { type: [Object, String] },
+    src: { type: String },
+    pageKey: { type: [String, Number] },
+    targeting: { type: Object }
+  },
+  emits: ["event"],
+  setup(props, { slots, emit }) {
+    const ual = (0, import_vue.shallowRef)(null);
+    const ready = (0, import_vue.ref)(false);
+    (0, import_vue.provide)(KEY, { ual, ready });
+    let off = null;
+    let mounted = false;
+    (0, import_vue.onMounted)(() => {
+      mounted = true;
+      startUal({
+        config: props.config,
+        src: props.src,
+        // eventi e targeting si agganciano PRIMA dell'init, così non si perde nulla
+        beforeInit: (u) => {
+          if (!mounted) return;
+          if (props.targeting) u.setTargeting(props.targeting);
+          off = u.on("*", (data, evt) => emit("event", evt, data));
+        }
+      }).then((u) => {
+        ual.value = u;
+        ready.value = true;
+      }).catch((e) => console.warn("[UAL]", e && e.message ? e.message : e));
+    });
+    (0, import_vue.onBeforeUnmount)(() => {
+      mounted = false;
+      if (off) off();
+    });
+    (0, import_vue.watch)(() => props.pageKey, () => {
+      if (ual.value) ual.value.pageView();
+    });
+    (0, import_vue.watch)(() => props.targeting, (t) => {
+      if (ual.value && t) ual.value.setTargeting(t);
+    }, { deep: true });
+    return () => slots.default ? slots.default() : null;
+  }
+});
+var AdSlot = (0, import_vue.defineComponent)({
+  name: "AdSlot",
+  props: {
+    name: { type: String, required: true },
+    params: { type: Object },
+    minHeight: { type: Number }
+  },
+  setup(props) {
+    return () => (0, import_vue.h)("div", {
+      "data-ad-slot": props.name,
+      "data-ad-params": props.params ? JSON.stringify(props.params) : void 0,
+      style: props.minHeight ? { minHeight: props.minHeight + "px" } : void 0
+    });
+  }
+});

package/dist/vue.d.ts

@@ -0,0 +1,21 @@
+import type { DefineComponent, Ref, ShallowRef } from 'vue';
+import type { Ual, UalConfig, Targeting, UalEventMap } from './index';
+
+/** Avvia UAL dopo il montaggio (solo browser), una volta per pagina. Emette `event` per gli eventi di UAL. */
+export const UalProvider: DefineComponent<{
+  config: UalConfig | string;
+  src?: string;
+  pageKey?: string | number;
+  targeting?: Targeting;
+}, {}, {}, {}, {}, {}, {}, {
+  event: <K extends keyof UalEventMap>(event: K, data: UalEventMap[K]) => void;
+}>;
+
+/** Una posizione pubblicitaria: un div vuoto che UAL riempie. */
+export const AdSlot: DefineComponent<{
+  name: string;
+  params?: Record<string, unknown>;
+  minHeight?: number;
+}>;
+
+export function useUal(): { ual: ShallowRef<Ual | null>; ready: Ref<boolean> };

package/dist/vue.mjs

@@ -0,0 +1,108 @@
+// src/vue.js
+import { defineComponent, h, inject, onBeforeUnmount, onMounted, provide, ref, shallowRef, watch } from "vue";
+
+// src/wrappers/start.js
+import { getUal } from "./index.mjs";
+var loading = /* @__PURE__ */ new Map();
+function loadFromCdn(src) {
+  if (window.ual && window.ual.version) return Promise.resolve(window.ual);
+  if (!loading.has(src)) {
+    loading.set(src, new Promise((resolve, reject) => {
+      const s = document.createElement("script");
+      s.async = true;
+      s.src = src;
+      s.onload = () => {
+        if (window.ual && window.ual.version) resolve(window.ual);
+        else reject(new Error("il loader caricato da " + src + " non ha esposto window.ual"));
+      };
+      s.onerror = () => {
+        loading.delete(src);
+        reject(new Error("impossibile caricare il loader da " + src));
+      };
+      document.head.appendChild(s);
+    }));
+  }
+  return loading.get(src);
+}
+async function startUal({ config, src, beforeInit }) {
+  const ual = src ? await loadFromCdn(src) : getUal();
+  if (beforeInit) beforeInit(ual);
+  const started = typeof ual.isInitialized === "function" && ual.isInitialized();
+  if (started) {
+    const p = typeof ual.whenReady === "function" ? ual.whenReady() : null;
+    if (p) await p;
+  } else {
+    await ual.init(config);
+  }
+  return ual;
+}
+
+// src/vue.js
+var KEY = /* @__PURE__ */ Symbol("ual");
+function useUal() {
+  return inject(KEY, { ual: shallowRef(null), ready: ref(false) });
+}
+var UalProvider = defineComponent({
+  name: "UalProvider",
+  props: {
+    config: { type: [Object, String] },
+    src: { type: String },
+    pageKey: { type: [String, Number] },
+    targeting: { type: Object }
+  },
+  emits: ["event"],
+  setup(props, { slots, emit }) {
+    const ual = shallowRef(null);
+    const ready = ref(false);
+    provide(KEY, { ual, ready });
+    let off = null;
+    let mounted = false;
+    onMounted(() => {
+      mounted = true;
+      startUal({
+        config: props.config,
+        src: props.src,
+        // eventi e targeting si agganciano PRIMA dell'init, così non si perde nulla
+        beforeInit: (u) => {
+          if (!mounted) return;
+          if (props.targeting) u.setTargeting(props.targeting);
+          off = u.on("*", (data, evt) => emit("event", evt, data));
+        }
+      }).then((u) => {
+        ual.value = u;
+        ready.value = true;
+      }).catch((e) => console.warn("[UAL]", e && e.message ? e.message : e));
+    });
+    onBeforeUnmount(() => {
+      mounted = false;
+      if (off) off();
+    });
+    watch(() => props.pageKey, () => {
+      if (ual.value) ual.value.pageView();
+    });
+    watch(() => props.targeting, (t) => {
+      if (ual.value && t) ual.value.setTargeting(t);
+    }, { deep: true });
+    return () => slots.default ? slots.default() : null;
+  }
+});
+var AdSlot = defineComponent({
+  name: "AdSlot",
+  props: {
+    name: { type: String, required: true },
+    params: { type: Object },
+    minHeight: { type: Number }
+  },
+  setup(props) {
+    return () => h("div", {
+      "data-ad-slot": props.name,
+      "data-ad-params": props.params ? JSON.stringify(props.params) : void 0,
+      style: props.minHeight ? { minHeight: props.minHeight + "px" } : void 0
+    });
+  }
+});
+export {
+  AdSlot,
+  UalProvider,
+  useUal
+};

package/docs/ad-server-esistenti.md

@@ -0,0 +1,78 @@
+# Connecting existing ad servers and banner exchanges
+
+The systems already in use (AdManager, Banner Exchange Pro, Banner Exchange and the two legacy PHP ones) connect to UAL **without modifying them**, using the `iframe` adapter: one provider per system, with the ID in the URL coming from the slot's `params`.
+
+> There is also an HTML version with examples that open in the configurator: `ual-configurator`, `/docs/` page ("I tuoi ad server" section).
+
+## The systems
+
+| Project | What it does | Public endpoints | When it is "empty" |
+|---|---|---|---|
+| `admanager-next` | Ad server: units with image or HTML-code ads, priorities, dates, impression and click caps, statistics, Stripe shop | `GET /api/iframe/{unit}`, `GET /api/embed/{unit}` (JS), `GET /api/click/{ad}` | No eligible ad: iframe with empty body, empty JS |
+| `bannerpro-next` | Credit-based banner exchange, 468×60 | `GET /api/display/{id}` (`?js=1`), `GET /api/click/{id}?hostid=` | Never: with no candidate it shows the "house" banner |
+| `banner-next` | Simpler banner exchange | `GET /api/work/{username}` | Empty body if there is no banner |
+| `banner/` (legacy PHP) | Original of `bannerpro-next` | `display.php?id=N` (`&js=1`), `click.php?hostid=&targetid=`, `banner.php` (house) | Never: with no candidate it shows a nested iframe with `banner.php` |
+| `banner/admanager/` (legacy PHP) | Original of `admanager-next`, without priorities, dates, caps or placeholder | `admanager/iframe.php?id=U`, `admanager/embed.php?id=U`, `admanager/click.php?ad=` | No ad: empty body |
+
+The Next rewrites and the legacy PHP share the same logic (rotation, credits, click counting).
+
+## Configuration
+
+Replace the domains with your own. The slot sizes must match the banner's: 468×60 for the exchanges (default value, editable in each system's settings), the unit's size for the ad servers.
+
+| System | URL | `params` | Sandbox |
+|---|---|---|---|
+| AdManager (Next) | `https://…/api/iframe/{params.unit}` | `{"unit": unit id}` | default |
+| AdManager (legacy) | `https://…/banner/admanager/iframe.php?id={params.unit}` | `{"unit": unit id}` | default |
+| Banner Exchange Pro (Next) | `https://…/api/display/{params.host}` | `{"host": member id}` | with top navigation |
+| Banner Exchange (Next) | `https://…/api/work/{params.user}` | `{"user": "username"}` (letters and numbers, max 15) | with top navigation |
+| Banner exchange (legacy) | `https://…/banner/display.php?id={params.host}` | `{"host": member id}` | default |
+
+```json
+{
+  "site": "my-site",
+  "consent": { "mode": "tcf" },
+  "providers": {
+    "adm_next":    { "adapter": "iframe", "consent": "contextual", "url": "https://admanager.yourdomain.net/api/iframe/{params.unit}" },
+    "adm_legacy":  { "adapter": "iframe", "consent": "contextual", "url": "https://banner.yourdomain.net/admanager/iframe.php?id={params.unit}" },
+    "exch_pro":    { "adapter": "iframe", "consent": "contextual", "url": "https://exchange.yourdomain.net/api/display/{params.host}",
+                     "sandbox": "allow-scripts allow-popups allow-popups-to-escape-sandbox allow-same-origin allow-top-navigation-by-user-activation" },
+    "exch_next":   { "adapter": "iframe", "consent": "contextual", "url": "https://exchange2.yourdomain.net/api/work/{params.user}",
+                     "sandbox": "allow-scripts allow-popups allow-popups-to-escape-sandbox allow-same-origin allow-top-navigation-by-user-activation" },
+    "exch_legacy": { "adapter": "iframe", "consent": "contextual", "url": "https://banner.yourdomain.net/display.php?id={params.host}" }
+  },
+  "slots": {
+    "top":     { "sizes": [[728, 90]],  "minHeight": 90, "providers": [{ "id": "adm_next",    "params": { "unit": 3 } }] },
+    "box":     { "sizes": [[300, 250]], "providers": [{ "id": "adm_legacy",  "params": { "unit": 5 } }] },
+    "footer1": { "sizes": [[468, 60]],  "providers": [{ "id": "exch_pro",    "params": { "host": 7 } }] },
+    "footer2": { "sizes": [[468, 60]],  "providers": [{ "id": "exch_next",   "params": { "user": "mario" } }] },
+    "footer3": { "sizes": [[468, 60]],  "providers": [{ "id": "exch_legacy", "params": { "host": 7 } }] }
+  }
+}
+```
+
+This is the configurator's "Your existing ad servers" example: it opens from `?esempio=ad-server-esistenti`.
+
+## Limits
+
+- **One system per slot.** The `iframe` adapter cannot know whether the banner is empty (the iframe has a different origin), so it always considers the slot filled and the waterfall stops there. Put it alone in the slot or at the last level. The exchanges show a default banner anyway when they have no candidate; the ad servers leave a blank box if the unit is empty.
+- **`target="_top"` links.** `bannerpro-next` and `banner-next` open the banner with `target="_top"`. The default sandbox does not allow navigating the top page, so without the override shown above the click does nothing. AdManager and the legacy PHP use `_blank` and work with the default sandbox. This behavior is verified by the tests (`test/regression.mjs`, group "iframe stile AdManager/scambio").
+- **IDs belong to each system.** `unit: 3` of AdManager (Next) and `unit: 3` of the legacy one are two different units in two different databases.
+- **Separate statistics.** Impressions and clicks stay counted by the system serving the banner (impression on the iframe request, click on the click endpoint). UAL's "viewable" tracker does not reach these systems.
+- **No selection by size.** AdManager's `pickAd` chooses by unit, not by requested size: each slot must point to a unit of the right size (different slots or units for mobile and desktop).
+- **`contextual` consent.** The Next systems' routes that were read (embed, iframe, click, display, work) set no cookies. The legacy PHP calls `session_start()` in `click.php` (session cookie on click) and `config.php` has not been checked: check the `Set-Cookie` header of `display.php` and `iframe.php` before keeping `contextual`, and have the privacy setup reviewed by whoever is responsible for it.
+- **AdManager `code` ads.** Today `/api/embed` inserts them into the page DOM when they contain `<script>`. In UAL they run in the isolated sandbox (separate iframe).
+
+## How to get a fallback after an ad server
+
+To let the waterfall continue after an ad server (for example AdSense or the house promo), the server must answer "empty" in a way the browser can read. The contract is that of the `json` adapter (see the README): a `POST` with the ready slots, answered with `{ "ads": [...] }` or `204`.
+
+For AdManager (Next) this would need an endpoint like `POST /api/ual/decide` that:
+
+- reuses `pickAd` and filters by the requested sizes;
+- answers `204` if there is nothing;
+- returns a `clickUrl` pointing to `/api/click/{id}` (and `type: "image"` or `"html"` for `code` ads);
+- handles CORS for the clients' domains;
+- counts impressions with a signed tracker (HMAC) instead of at selection time, so an ad discarded by UAL is not counted.
+
+It has not been implemented: the existing projects have not been modified.

package/docs/cdn.md

@@ -0,0 +1,58 @@
+# Publishing UAL: the files to put on the CDN
+
+With the `<script>` **tag**, or with the components in "On your CDN" mode (`src` + `config` as a URL), **two files** go on the CDN. An HTML version with examples is in the configurator guide (`/docs/#pubblicare`).
+
+## The files
+
+| File | Where it comes from | Example address |
+|---|---|---|
+| **The loader** | `dist/ual.min.js` of this project, after `npm run build` (about 25 KB, 10 KB gzipped) | `https://adcdn.yourdomain.net/ual.min.js` |
+| **The configuration** | the JSON downloaded from the configurator (*JSON* tab ▸ *Download*), named `<site-id>.json` | `https://adcdn.yourdomain.net/config/<site-id>.json` |
+
+One configuration file per site. In the configurator's *Snippet* tab you set the domain, the loader name and the configuration path: the address it shows is the exact one and the generated snippet already points there.
+
+```
+cdn/
+├── ual.min.js                  ← the loader: the same file for all sites
+└── config/
+    ├── mario-pizzeria.json     ← the configuration: one per site
+    └── another-site.json
+```
+
+## Headers
+
+| File | Headers | Why |
+|---|---|---|
+| Configuration | `Content-Type: application/json`, `Access-Control-Allow-Origin: *`, `Cache-Control: public, max-age=120` | The loader reads it with `fetch` from another domain (without cookies, so `*` is fine). Short cache (1–5 minutes) so changes go live quickly |
+| Loader | `Content-Type: text/javascript`, longer cache; enable gzip or brotli | Loaded with `<script src>`: no CORS |
+
+For the loader it is best to use a versioned path plus an alias for urgent releases:
+
+```
+cdn/
+├── v0.1.0/ual.min.js           ← long cache (public, max-age=31536000, immutable)
+├── ual.min.js                  ← alias, short cache (public, max-age=300)
+└── config/
+    └── mario-pizzeria.json
+```
+
+## What is not needed
+
+- `index.mjs`, `react.mjs`, `vue.mjs` and the other files in `dist/` other than `ual.min.js`: they are for the npm package.
+- `dist/ual.js` (not minified): optional, only useful to read the code in the browser while debugging.
+- The JSON schema, the documentation and the types.
+
+## Special cases
+
+- **Package with the config in the code** (`defineConfig`, component without `src`): nothing is needed on the CDN, UAL and the configuration are in the site bundle.
+- **Existing ad servers only** (`iframe` adapter, see `ad-server-esistenti.md`): the same two files apply; the IDs and URLs are already in the configuration.
+- **House creative images** (e.g. `https://cdn.yourdomain.net/promo/728x90.webp`): they are a third type of file, uploaded wherever you like and referenced in the configuration. They are not part of UAL and need no CORS headers (they are shown in an isolated iframe).
+
+## Publishing and updating
+
+1. Download the JSON from the configurator.
+2. Upload it to the CDN at the address shown in *Snippet*; also upload `ual.min.js` (once, or with every new loader version).
+3. Paste the snippet (or the framework code) into the site.
+4. **To change providers, slots or rules:** edit in the configurator, download the JSON again and upload it **to the same address**. Sites pick it up on the next visit, after the cache expires.
+
+In SPAs using the tag, `ual.pageView()` must be called on every page change (the components do it on their own). Before replacing the configuration of a live site, publish with a test ID and check the log with `?ual_debug=1`.

package/docs/esempio.md

@@ -0,0 +1,156 @@
+# Complete example: client site with its own ad server, AdSense and house promos
+
+## 1. On the client's site
+
+```html
+<head>
+  <script async src="https://adcdn.yourdomain.net/ual.min.js"
+          data-config="https://adcdn.yourdomain.net/config/mario-pizzeria.json"></script>
+</head>
+<body>
+  <div data-ad-slot="top"></div>
+  <article>…</article>
+  <div data-ad-slot="sidebar"></div>
+  <div data-ad-slot="bottom"></div>
+</body>
+```
+
+## 2. Configuration (`mario-pizzeria.json` on the CDN)
+
+```json
+{
+  "site": "mario-pizzeria",
+  "consent": { "mode": "tcf", "requiredPurposes": [1] },
+  "targeting": { "category": "food", "city": "milan" },
+
+  "providers": {
+    "mine":    { "adapter": "json", "endpoint": "https://ads.yourdomain.net/v1/decide" },
+    "adsense": { "adapter": "adsense", "client": "ca-pub-1111111111", "consent": "required" },
+    "promo":   { "adapter": "house", "creatives": [
+      { "type": "image", "src": "https://adcdn.yourdomain.net/promo/728x90.webp",
+        "width": 728, "height": 90, "clickUrl": "https://horbit.it" },
+      { "type": "image", "src": "https://adcdn.yourdomain.net/promo/320x100.webp",
+        "width": 320, "height": 100, "clickUrl": "https://horbit.it" }
+    ]}
+  },
+
+  "slots": {
+    "top": {
+      "label": "Advertising", "minHeight": 90, "lazy": false,
+      "sizeMapping": [
+        { "minWidth": 0,   "sizes": [[320, 100]] },
+        { "minWidth": 768, "sizes": [[728, 90]] }
+      ],
+      "providers": [{ "id": "mine", "params": { "zone": 10 } }, "promo"]
+    },
+    "sidebar": {
+      "sizes": [[300, 250]],
+      "providers": [{ "id": "mine", "params": { "zone": 11 } },
+                    { "id": "adsense", "params": { "slot": "2222222222" } }]
+    },
+    "bottom": {
+      "sizes": [[728, 90]],
+      "providers": [{ "id": "mine", "params": { "zone": 12 } }]
+    }
+  },
+
+  "pageRules": [
+    { "match": "^/menu", "disable": ["bottom"], "targeting": { "section": "menu" } }
+  ]
+}
+```
+
+## 3. Flow on a desktop visit to the home page
+
+1. The loader reads the config and waits for the CMP.
+2. `top` and `sidebar` are in the viewport and start together with **a single** call:
+
+```json
+POST https://ads.yourdomain.net/v1/decide
+{
+  "site": "mario-pizzeria",
+  "page": { "url": "https://mariopizzeria.it/", "path": "/" },
+  "device": "desktop",
+  "targeting": { "category": "food", "city": "milan" },
+  "consent": { "gdprApplies": true, "tcString": "CQ…", "granted": true },
+  "slots": [
+    { "id": "top#1",     "name": "top",     "sizes": [[728,90]],  "params": { "zone": 10 } },
+    { "id": "sidebar#2", "name": "sidebar", "sizes": [[300,250]], "params": { "zone": 11 } }
+  ]
+}
+```
+
+3. The server has a campaign only for `top`:
+
+```json
+{ "ads": [ {
+  "slotId": "top#1", "type": "image",
+  "src": "https://adcdn.yourdomain.net/c/beer-xyz-728.webp",
+  "width": 728, "height": 90,
+  "clickUrl": "https://ads.yourdomain.net/c?t=eyJ…",
+  "trackers": {
+    "impression": ["https://ads.yourdomain.net/i?t=eyJ…"],
+    "viewable":   ["https://ads.yourdomain.net/v?t=eyJ…"]
+  }
+} ] }
+```
+
+4. Result:
+   - **top**: banner shown in an isolated iframe, impression tracker fired; after 1 s at 50% visibility the viewable tracker fires.
+   - **sidebar**: empty on your server → the client's AdSense (loaded only because consent is present).
+   - **bottom**: requested only when the user scrolls near it; if empty, the slot hides.
+   - **/menu**: `bottom` is not loaded, the targeting includes `section: menu`.
+
+## 4. Minimal `decide` endpoint (Node/Fastify)
+
+```js
+import Fastify from 'fastify';
+const app = Fastify();
+
+// CORS: a POST with a JSON Content-Type from another domain first triggers an OPTIONS preflight.
+// Without these headers and without the OPTIONS route the browser blocks every request.
+// ('*' is fine because the adapter sends no cookies; with withCredentials you need the exact origin.)
+app.addHook('onRequest', async (req, reply) => {
+  reply.header('Access-Control-Allow-Origin', '*');
+  reply.header('Access-Control-Allow-Methods', 'POST, OPTIONS');
+  reply.header('Access-Control-Allow-Headers', 'Content-Type');
+  reply.header('Access-Control-Max-Age', '600');
+});
+app.options('/v1/decide', async (req, reply) => reply.code(204).send());
+
+app.post('/v1/decide', async (req, reply) => {
+  if (!req.body || !Array.isArray(req.body.slots)) return reply.code(400).send();
+  const { site, slots, consent, targeting } = req.body;
+
+  const ads = [];
+  for (const s of slots) {
+    // placeholder: banner selection in your ad server
+    const banner = await myAdServer.pick({ site, zone: s.params.zone, sizes: s.sizes, targeting });
+    if (!banner) continue; // empty -> next provider
+
+    const t = sign({ b: banner.id, s: site, z: s.params.zone }); // placeholder: HMAC token
+    ads.push({
+      slotId: s.id, type: 'image', src: banner.imageUrl,
+      width: banner.w, height: banner.h,
+      clickUrl: `https://ads.yourdomain.net/c?t=${t}`,
+      trackers: {
+        impression: [`https://ads.yourdomain.net/i?t=${t}`],
+        viewable:   [`https://ads.yourdomain.net/v?t=${t}`],
+      },
+    });
+  }
+  return ads.length ? { ads } : reply.code(204).send();
+});
+```
+
+`/c`, `/i`, `/v` verify the token and record the event; `/c` redirects to the landing page.
+
+## 5. Page-side events
+
+```js
+window.ual = window.ual || { cmd: [] };
+ual.cmd.push(u => {
+  u.on('slotRendered', e => console.log('shown', e.slot, 'by', e.provider));
+  u.on('slotEmpty',    e => console.log('empty', e.slot));
+});
+```