feat(consent): CMP adapters for Cookiebot, OneTrust, and Complianz

[Atroci]

Part of #39 (adapters; the cmp-booking-handoff example follows in clicktrail-examples). Implements specs/003-cmp-adapters (spec in #40).

Acceptance criterion

@vizuh/clicktrail-consent/cmp connects Cookiebot, OneTrust and Complianz to a ConsentHub:

• the landing-page click survives a Cookiebot wipe that happens before its accept event;
• decline and in-page withdrawal emit denied;
• the import has no side effects without a window.

Design

• An injectable target (window-like) seam, with no DOM access at import. sideEffects: false still holds.
• state follows marketing consent, because storageAllowed() checks only state. This matches the WordPress bridge.
• Deduplication per decision. The adapters stay subscribed (no once) and return disposers.
• Cookiebot: emits only once hasResponse is set.
• OneTrust: exact group matching (C00040 does not match C0004). Listens to OneTrustGroupsUpdated as well as the OptanonWrapper wrap.
• Complianz: cmplz_has_consent(), falling back to event.detail.categories, per the Complianz developer guide.

Review notes

/code-review raised 4 findings. Fixed:

• the install snippet overwriting OptanonWrapper silenced the adapter; it now also uses OneTrustGroupsUpdated;
• dispose leaked when another wrapper sat on top; a disposed flag fixes it.

Documented rather than changed: OneTrust and Complianz report the CMP's effective state before an answer. With an opt-in banner that's denied, which is harmless. In an opt-out region the CMP itself configures, it's granted, the same state the CMP uses for its own tags, and the same as the WordPress bridge. The README states this. The spec's FR-004 wording ("never emit while pending") holds strictly only for Cookiebot, and #40 should be amended to match.

Validation

• packages/consent: 19 tests (13 new) cover:
  • wipe then accept;
  • decline;
  • existing response at connect, then in-page withdrawal;
  • analytics-only consent does not unlock storage;
  • dispose;
  • OneTrust exact groups, host wrapper, snippet overwrite and wrapped dispose;
  • Complianz categories, cmplz_has_consent withdrawal and banner-open;
  • SSR no-op.
• Full workspace: pnpm -r test green, pnpm typecheck clean, and verify:workspace passes for 23 packages.
• Size: the cmp dist is 1,801 B gzip unminified, an upper bound against the 2 KB budget. The repo has no size tool, so none was added.
• Built dist/cmp/index.js imports in Node without a window.
• Not published. It ships with the next RC wave.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7de0f6284a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Handle category-only Complianz status changes

When cmplz_has_consent is unavailable—the explicitly supported fallback case—Complianz's later cmplz_status_change events provide the changed detail.category and detail.value, rather than a detail.categories array. After an initial cmplz_fire_categories grant, a subsequent marketing withdrawal therefore skips this branch and returns without notifying the hub, leaving stored attribution uncleared. Preserve the fallback category state and apply these category/value updates.

Useful? React with 👍 / 👎.