# Klaro Open Source 0.7.22

Unmodified, prebuilt `dist/klaro-no-css.js` and `dist/klaro.min.css` from tag `v0.7.22`, commit
`6ccb3534daaba8114ecd2223a8dc688da13c4e3d`. No CDN or Klaro Cloud calls at runtime.
`provenance.json` records download URLs and SHA-256 checksums. `.gitattributes`
preserves the downloaded bytes across platforms.

The full Klaro UI is used as described by the
[upstream README](https://github.com/kiprotect/klaro/tree/v0.7.22#getting-started).
`../../consent.js` sets `window.klaroConfig` before loading the local script and CSS.
It fixes `lang`/`fallbackLang` to `de`. On the user's explicit request,
`../../klaro-de-du.js` changes only the formal address and its grammar to Du
through Klaro's supported translation configuration; all other text is inherited.
`de.yml` is the unchanged upstream source of the bundled German text, retained
for provenance. No service-specific legal notice is provided by this language file.

The integration adds brand colors, keyboard focus/inert handling, accessible
checkboxes and a permanent one-click decline action using Klaro's original
German `decline` translation. These adapters do not edit the vendor files or
replace the substance of the standard notice/modal copy. The configured service title is product
metadata; a separate reviewed service description and its source are required
before activation. Technical failure notifications remain integration-specific.

Klaro's manager is bootstrapped with its memory store (`storageMethod: 'test'`);
before rendering or applying saved choices, the versioned/expiring localStorage
adapter replaces that store. The save boundary also stops measurement before a
decline and reports persistence errors. These pinned-version integration points
must be rechecked on an upstream update.

`LICENSE` is Klaro's BSD-3-Clause license. The bundled core-js 3.36.0,
Preact 10.19.6 and classnames 2.5.1 licenses are retained separately. The
website itself still has no framework/build pipeline.

For an update: review the upstream changes and release/tag commit, download its
prebuilt UI, CSS, German translation source and applicable licenses, replace the versioned directory
and reference in `consent.js`, and update the checksums. Do not edit minified vendor
code. Run the website QA and full consent/browser tests before publishing.
Increment the consent/privacy versions for material changes to purposes or data
processing, not merely because an unchanged vendor dependency was updated.