# Installing Kockica on a website — instructions for AI coding agents

_This file is for agents installing Kockica on a site. Agents developing Kockica itself: see `CLAUDE.md`._

You were asked to add Kockica (`@datavallis/consent`) to a project. Follow these steps in order. The README in this
package is the full reference (options, Next.js, limits); this file is the procedure.

Kockica is a cookie consent banner: it detects and blocks known trackers until the visitor consents, runs Google
Consent Mode v2, builds the cookie table for the policy page and speaks 22 languages
(en, sl, de, hr, it, fr, es, pt, nl, da, pl, cs, sk, hu, bg, uk, ru, el, sq, sv, fi, nb; `no` / `nn` map to `nb`).

Work on a branch and deploy to a development/staging environment only. Never deploy to production yourself.

## 1. Survey first, report before changing code

- **Stack:** Next.js (App or Pages Router), another bundler app (React, Vue, Svelte, Nuxt …), WordPress, static HTML, other.
- **Languages:** which languages the site has, how `<html lang>` is set (must be the 2-letter code: `en`, `de`, `uk` not
  `ua`, `sq`, `el`), and the cookie / privacy policy URL for **each** language.
- **Existing cookie banners:** search for `cookieyes`, `cky-`, `cookiebot`, `CookieConsent`, `onetrust`, `iubenda`,
  `complianz`, `cookie-law-info`, `klaro`, `osano`, `usercentrics`.
- **Trackers and embeds:** GA4 / gtag, Google Tag Manager, Google Ads, AdSense, Meta Pixel, Hotjar, Microsoft Clarity,
  LinkedIn Insight, TikTok Pixel, YouTube, Vimeo, Google Maps, anything else — and **how** each is loaded (raw
  `<script>` in HTML/JSX, `next/script`, GTM, an npm SDK, `<iframe src>` in markup).
- **Controller:** the legal company name and city of the site owner. If you do not know it, ask. Never guess.
- **Stop and ask the owner if the site serves Google AdSense / Ad Manager ads.** Kockica is not a Google-certified
  IAB TCF CMP; personalised ads in the EEA, UK and Switzerland would stop. The owner decides.

## 2. Remove the old banner completely

Script tags, init code, CSS overrides, its cookie list on policy pages, env vars, CSP entries. Code that waited for the
old banner's consent events or read its cookie must go: load those trackers normally and let Kockica block them.
**Do not write your own "wait for consent" logic.** List any GTM triggers that depended on the old banner in your
report; do not change GTM yourself.

## 3. Install

Always use the latest published version.

### Next.js (App Router)

```bash
npm i @datavallis/consent@latest
```

`app/kockica.tsx`:

```tsx
'use client';
import { initConsent } from '@datavallis/consent';
import '@datavallis/consent/style.css';

// Cookie policy URL per language. FIRST entry = fallback language.
const COOKIE_POLICY: Record<string, string> = {
  en: '/en/cookie-policy',
};

// Module top level, NOT useEffect: runs before next/script (afterInteractive) tags.
if (typeof window !== 'undefined') {
  const lang = document.documentElement.lang.slice(0, 2);
  initConsent({
    siteId: 'my-site',
    controller: { name: 'Example Ltd., Ljubljana' },
    policyUrl: COOKIE_POLICY[lang] ?? COOKIE_POLICY.en!,
    languages: Object.keys(COOKIE_POLICY),
  });
}

export default function Kockica() {
  return null;
}
```

Root layout: `<html lang={locale}>`; in `<head>`, **before any Google tag**,
`<script dangerouslySetInnerHTML={{ __html: consentModeDefaultsSnippet() }} />` (import `consentModeDefaultsSnippet`
from `@datavallis/consent`); `<Kockica />` first in `<body>`.

### Other bundler apps

The same `initConsent({ … })` call at the top of the client entry file, before analytics is initialised. Consent Mode
snippet in the HTML `<head>` before Google tags.

### WordPress, static HTML, anything without a bundler

First element in `<head>`:

```html
<script
  src="https://cdn.jsdelivr.net/npm/@datavallis/consent@0.5/dist/kockica.min.js"
  data-site-id="my-site"
  data-controller="Example Ltd., Ljubljana"
  data-policy-url="/cookie-policy"
  data-languages="en"
></script>
```

Replace `0.5` with the current major.minor (`npm view @datavallis/consent version`). On multilingual sites, output the page's own policy URL in
`data-policy-url` from the template. List only languages the site really has.

## 4. Trackers and embeds

- Known trackers (GA4, Google Ads, GTM, Meta Pixel, Hotjar, Clarity, LinkedIn Insight, TikTok Pixel, YouTube, Vimeo,
  Google Maps) are detected and blocked automatically. Load them normally (Next.js: `next/script`, strategy
  `afterInteractive` or later).
- Never leave a tracker `<script src>` written directly in HTML/JSX `<head>`: the browser may fetch it before Kockica
  runs. Move it to `next/script` / JS, or tag it.
- Unknown trackers: `<script type="text/plain" data-category="analytics|marketing|functional" src="…">`.
- `<iframe src>` embeds written in markup: `<iframe data-kockica-category="marketing" data-src="…">`.
- Google tags stay loaded but cookieless until consent (`googleMode: 'advanced'`, default). Set `googleMode: 'basic'`
  only if the owner asks.
- Remove trackers the owner says are not used.
- Tell the owner: when marketing later adds a known tracker (or anything through GTM), Kockica asks visitors again by
  itself; no developer and no `revision` bump needed. Only unknown scripts pasted into HTML need tagging.

## 5. Policy pages and footer

- Cookie policy page, every language: `<div data-kockica-cookie-table></div>` (React: add `suppressHydrationWarning`).
  Remove the old banner's cookie list.
- Footer, every page, localised label: `<a href="#" data-kockica-preferences>Cookie settings</a>`.
- If the policy text says embeds (YouTube, Maps) run on legitimate interest, flag it: with Kockica they need consent.

## 6. Test on the development environment

Private window, at least two languages, desktop and mobile:

1. Banner in the page language; "Accept all", "Reject all", "Settings" look identical.
2. Before a choice: no `_ga`, `_fbp`, `_hj*`, `_clck`, `_ttp` cookies; no requests to facebook, hotjar, clarity,
   tiktok, linkedin, youtube; Google requests (if any) carry `gcs=G100`.
3. "Reject all" → only `kockica_consent` plus the site's own technical cookies.
4. "Accept all" → trackers load; `dataLayer` has a `consent` `update` with `granted`.
5. Footer link and corner button reopen the settings; withdrawing consent works.
6. Cookie table filled, also after an in-app (client-side) navigation.
7. No requests or cookies from the old banner; no console or hydration errors.

## 7. Report to the owner

Files changed; trackers found and how each is handled; old-banner leftovers (including GTM triggers); open questions
(controller name, policy URLs, AdSense); test results with screenshots of the banner in two languages and of the
cookie list after "Reject all".
