@aglyn/aglyn 1.0.0-beta.143

package/src/lib/app-utils/advertising-tags.js

@@ -0,0 +1,525 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * The VENDOR-AGNOSTIC advertising-tag gate.
+ *
+ * ## The hole this closes
+ *
+ * Until now the consent machinery could gate exactly one thing: Google. The
+ * `advertising` category has existed since AGL-1649 and it is honest — a
+ * refusal always wins, and a host that never asked gets nothing — but the
+ * only ENFORCEMENT it ever reached was {@link consentModeSignals}, four
+ * strings handed to `gtag`. A non-Google tag could not be consent-gated at
+ * all, because nothing in the repo knew how to gate one. Deciding to deploy a
+ * Meta Pixel with that as the state of the art would have meant either
+ * shipping it ungated or inventing a second consent implementation beside the
+ * first — the outcome AGL-1579 explicitly ruled out.
+ *
+ * This module is the missing enforcement channel, built for vendors in
+ * general and populated with one descriptor. **Deploying the Meta Pixel is a
+ * separate decision and this module does not take it** — see "What is NOT
+ * wired" below.
+ *
+ * ## Why the gate is STRUCTURAL
+ *
+ * The lesson AGL-1498 paid for and AGL-1608 paid for again: a boolean checked
+ * before each call is not a gate. A resident tag fires on its own — GA4
+ * enhanced measurement re-created `_ga_YW5PG16YTM` on aglyn.com after a
+ * hand-run sweep to zero cookies, from one scroll to the footer — so the only
+ * enforcement that holds is the tag never being in the document.
+ *
+ * So the shape here mirrors the GA gate exactly:
+ *
+ * - {@link resolveAdvertisingTags} is a PURE verdict over the host document
+ *   and the visitor's stored record. It returns the tags that may exist. An
+ *   ungranted visitor gets an empty array, the component renders no
+ *   `<Script>`, and no request goes to the vendor. Not loaded-then-suppressed:
+ *   not loaded.
+ * - {@link revokeAdvertisingTags} exists because the gate CANNOT unload a tag.
+ *   Dropping the element on a mid-pageview withdrawal leaves the vendor's
+ *   script executing, so withdrawal additionally revokes consent on the
+ *   resident tag, removes its script elements, and sweeps its cookies — in
+ *   that order, for the AGL-1608 reason: sweeping first deletes the cookies
+ *   and immediately gets them back.
+ *
+ * ## The six conditions, all independent, all required
+ *
+ * 1. **{@link isPlatformMarketingHost}** — Aglyn's own marketing site, never a
+ *    customer's. This is the DPA §3.2 boundary: Aglyn promises customers it
+ *    does not "sell"/"share" Customer Personal Data, and an ad pixel on a
+ *    customer's published site — or in the console — would breach that. Note
+ *    the console needs no condition of its own: it does not render the tenant
+ *    runtime's analytics component at all, so there is no mount point to gate.
+ * 2. **{@link analyticsMayEmit}** — a real production deployment. AGL-2067's
+ *    finding was that `next dev` and Vercel PREVIEW builds resolve
+ *    `aglyn.com`'s host document exactly as production does; without this a
+ *    preview deploy would build real retargeting audiences out of our own
+ *    engineers.
+ * 3. **{@link hostConsentRequired}** — the consent machinery is actually live
+ *    for this site. A host that switched the tool off (`consent.disabled`)
+ *    runs their own CMP and ours has no answer on file to act on.
+ * 4. **{@link advertisingGrantedByRecord}** — the host asks about advertising
+ *    AND the visitor explicitly said yes to that specific category. This is
+ *    where the region behaviour is INHERITED rather than reimplemented: an
+ *    EEA/UK visitor pre-choice has no record, an unknown-region visitor has no
+ *    record, a US `implied` visitor's status cannot carry an advertising
+ *    grant, and `gpc-opt-out` cannot either. There is deliberately no country
+ *    logic in this file.
+ * 5. **A configured, well-formed account id for a KNOWN vendor.** The gate
+ *    describes what may load; the host document decides what is configured.
+ * 6. **{@link readInternalTrafficOverride} is false** — this browser has not
+ *    been declared one of ours. A GA4 data filter is PROPERTY-scoped: it drops
+ *    `traffic_type: internal` hits from the GA4 property and has no reach into
+ *    an `AW-`/Meta/LinkedIn destination at all, which are separate products
+ *    reached by separate requests. Measured on `aglyn.com`: a flagged browser's
+ *    pageview is correctly absent from GA4 while the same pageview still sends
+ *    `ccm/collect`, `pagead/1p-user-list` (`is_vtc=1`) and
+ *    `viewthroughconversion` to Google Ads, joining our own staff to the
+ *    remarketing audiences those requests build. Excluding ourselves from the
+ *    reports while still training the bidding on ourselves is the worse half of
+ *    the problem, because it is the half nobody can see in a report.
+ *
+ *    This is the same browser-scoped opt-in the GA4 stamp uses, so one visit to
+ *    `?aglyn_internal=1` covers both, and the two cannot drift apart into a
+ *    browser that is internal for one product and external for the other. Note
+ *    it is the BROWSER, not the account: staff ID-token claims are the console
+ *    mechanism (AGL-1582) and there is no account to consult here.
+ *
+ *    {@link analyticsEnvironmentForcesInternal} is the other half of the same
+ *    condition. Condition 2 passes under the non-production escape hatch, and a
+ *    build that emits because someone asked it to is ours by definition — so
+ *    the hatch must not hand a dev or preview build the real `AW-` id. Without
+ *    this the hatch reopens precisely the hole condition 2 closes, which is why
+ *    `INTERNAL_TRAFFIC_FORCED_SNIPPET` exists on the GA side.
+ *
+ * ## What is NOT wired, and why that is the point
+ *
+ * No host document carries an `analytics.adTags` entry. The Meta descriptor
+ * below is a description of how that vendor would be loaded and — more
+ * importantly — how it would be torn down; it is inert until someone writes a
+ * pixel id onto the `aglyn-marketing` host. That makes deployment a DATA
+ * change reviewed on its own merits, exactly as configuring GA is, rather than
+ * something that rides along with this mechanism.
+ *
+ * ## Why customer sites are excluded outright rather than offered this
+ *
+ * A customer-facing "run your own ad pixel" feature is a different product
+ * decision with its own consent copy, its own cookie-policy rows and its own
+ * DPA implications. Nothing here forecloses it. What this module must not do
+ * is arrive as that feature by accident.
+ */ import { GOOGLE_ADS_ID_PATTERN, LINKEDIN_PARTNER_ID_PATTERN, META_PIXEL_ID_PATTERN } from "./visitor-consent.js";
+import { analyticsEnvironmentForcesInternal, analyticsMayEmit, readAnalyticsEnvironment } from "./analytics-environment.js";
+import { readInternalTrafficOverride } from "./internal-traffic.js";
+import { isPlatformMarketingHost } from "./platform-marketing-host.js";
+import { ADVERTISING_COOKIE_PREFIXES, advertisingGrantedByRecord, clearCookiesWithPrefixes, hostConsentRequired } from "./visitor-consent.js";
+/**
+ * The attribute every script element this module renders carries.
+ *
+ * Load-bearing for the teardown, not decoration. {@link revokeAdvertisingTags}
+ * acts ONLY on elements carrying it, so a vendor tag a customer pasted into
+ * their own site's Custom HTML is never touched by our withdrawal path — we
+ * did not load it, we do not know what basis it runs on, and silently killing
+ * it would be us configuring a customer's site. Its value is the vendor id.
+ */ export const ADVERTISING_TAG_ATTRIBUTE = 'data-aglyn-ad-tag';
+/**
+ * Meta (Facebook/Instagram) Pixel.
+ *
+ * ## What happens to `_fbp` / `_fbc` on withdrawal: they are DELETED
+ *
+ * Not merely stopped. The decision is inherited, not invented: AGL-1606
+ * settled that a withdrawal "cleans up, it does not merely stop adding" for
+ * the GA equivalents, and there is no honest reading under which Meta's
+ * first-party identifiers get a softer rule than Google's. Both are
+ * browser-lifetime identifiers written by an advertising tag under a consent
+ * the visitor has just withdrawn.
+ *
+ * They are swept with the SAME ladder as `_ga` — the exact hostname and every
+ * domain up to the registrable one — because Meta writes them the same way GA
+ * does: path `/`, first-party, at the registrable domain. A deletion aimed at
+ * the exact hostname would silently no-op.
+ *
+ * Two limits, stated rather than glossed. Any copy Meta already ingested is
+ * gone from our reach — deletion stops future joins, it does not retract past
+ * ones; the CPRA opt-out title on the control is about the ongoing "share",
+ * which this does stop. And a cookie written at a path other than `/` is not
+ * reachable through `document.cookie`; Meta does not write one.
+ *
+ * ## Why `consent revoke` is called BEFORE the sweep
+ *
+ * `fbq('consent', 'revoke')` is Meta's documented CMP control and the exact
+ * counterpart of the `ga-disable-<id>` flag. Skipping it and going straight to
+ * the cookies reproduces AGL-1608: the resident pixel's next automatic event
+ * re-writes `_fbp` and the sweep un-does itself inside the same pageview.
+ */ export const META_PIXEL_VENDOR = {
+    id: 'meta',
+    label: 'Meta Pixel',
+    // Meta pixel ids are numeric; the length band is generous on both sides
+    // rather than pinned to today's 15-16 digits.
+    accountIdPattern: META_PIXEL_ID_PATTERN,
+    scriptSrc: 'https://connect.facebook.net/en_US/fbevents.js',
+    scriptMatch: 'connect.facebook.net',
+    cookiePrefixes: [
+        '_fbp',
+        '_fbc'
+    ],
+    bootSnippet: (accountId)=>// Meta's own shim, then an EXPLICIT grant, then init. The explicit grant
+        // is the AGL-1622 move applied to this vendor: the tag's first hit should
+        // carry a state someone actually chose rather than the vendor's built-in
+        // default, and declaring it before `init` means the automatic PageView is
+        // already covered by it. Reached only where the gate said yes.
+        "!function(f,b,e,v,n,t,s){if(f.fbq)return;n=f.fbq=function(){n.callMethod?" + "n.callMethod.apply(n,arguments):n.queue.push(arguments)};" + "if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0';n.queue=[]}" + '(window,document);' + "fbq('consent', 'grant');" + `fbq('init', '${accountId}');` + "fbq('track', 'PageView');",
+    setConsent: (scope, granted)=>{
+        try {
+            const fbq = scope.fbq;
+            if (typeof fbq === 'function') {
+                ;
+                fbq('consent', granted ? 'grant' : 'revoke');
+            }
+        } catch (unused) {
+        // A tag that throws on its own consent call is one we cannot silence
+        // that way; the element removal and the cookie sweep still stand.
+        }
+    }
+};
+/**
+ * Google advertising storage — a SWEEP-ONLY vendor (AGL-2486).
+ *
+ * There is no Google ad script for this module to load. `_gcl_*` and `_gac_*`
+ * are written by the GA4 gtag that `site-analytics.tsx` already mounts, once
+ * the visitor's `ad_storage` is granted. So the tag is somebody else's to
+ * mount and somebody else's to signal; what belongs here is the half nobody
+ * owned, which is the cookies.
+ *
+ * `_gcl_au` is the specific reason this exists. It does not begin with `_ga`,
+ * so {@link ANALYTICS_COOKIE_PREFIXES} never reached it, and `revokeAdvertisingTags`
+ * could not either — that function acts on marked script ELEMENTS, and there
+ * has never been one for Google. The cookie therefore survived every
+ * withdrawal on every surface. See {@link ADVERTISING_COOKIE_PREFIXES} for why
+ * the prefix is `_gcl` ALONE and cannot reach `_ga`/`_gid`.
+ *
+ * ⚠️ `_gac` is NOT in that list and must not be added back. It is written
+ * under the analytics loader, sits in the `Google Analytics` row of
+ * `apps/console/constants/cookie-inventory.ts`, and is already swept by the
+ * `_ga` prefix; `advertising-cookie-sweep.spec.ts` pins it as analytics-owned.
+ * An earlier version of this comment named it here, and a published Cookie
+ * Policy line describing `_gac` as advertising-gated traces to exactly that.
+ *
+ * The prefixes are IMPORTED rather than restated. They are consumed in two
+ * places — the universal sweep in `storeVisitorConsent` and the element-scoped
+ * one below — and a second copy would be a second thing to forget.
+ */ export const GOOGLE_ADS_VENDOR = {
+    id: 'google-ads',
+    label: 'Google advertising',
+    /*
+   * A LOADER now, not sweep-only (AGL-1152).
+   *
+   * It was sweep-only because Google's ad tags arrived through something else
+   * — a GA4 id or a GTM container — so there was nothing of ours to mount and
+   * only cookies to clear. That made advertising reachable ONLY through an
+   * analytics product: a site that wanted Google Ads and no analytics had no
+   * route at all, and the CSP gate that reads `adTags` never opened for it.
+   *
+   * `gtag.js` with an `AW-` id is Google's own documented install for Ads
+   * without Analytics. The same library serves both products; what differs is
+   * the id it is configured with, which is why the two patterns are separate
+   * and neither field accepts the other's.
+   */ accountIdPattern: GOOGLE_ADS_ID_PATTERN,
+    // Keeps the AGL-2486 sweep it had as a sweep-only vendor: `_gcl_*` is
+    // written by any Google tag, including ones we never marked.
+    alwaysSweep: true,
+    scriptSrc: 'https://www.googletagmanager.com/gtag/js',
+    // The loader carries the account, because gtag resolves the container from
+    // the query rather than from the `config` that follows. See `scriptSrcFor`;
+    // reached only when `sharesLibrary` did NOT find a loader to ride.
+    scriptSrcFor: (accountId)=>`https://www.googletagmanager.com/gtag/js?id=${accountId}`,
+    // The GA4 measurement id loads this exact library. See `sharesLibrary`.
+    sharesLibrary: 'googletagmanager.com/gtag/js',
+    scriptMatch: 'googletagmanager.com/gtag/js',
+    cookiePrefixes: ADVERTISING_COOKIE_PREFIXES,
+    bootSnippet: (accountId)=>/*
+     * DENIED FIRST, then granted — the AGL-1622 order.
+     *
+     * `gtag('consent', 'default', …)` has to run before the config, or the
+     * library's own default applies to the first hit. This snippet is reached
+     * only where the gate already said yes, so the grant follows immediately;
+     * declaring the default anyway is what makes the first hit carry a state
+     * somebody chose rather than Google's.
+     *
+     * `ad_user_data` and `ad_personalization` are named alongside
+     * `ad_storage`: Consent Mode v2 treats them as separate signals, and a
+     * grant that sets only storage leaves the other two at the library's
+     * default on every EEA request.
+     */ /*
+     * NO `consent default` here, deliberately.
+     *
+     * A default is a page-level declaration and something else may already
+     * have made it — the GA4 loader above declares one, and re-declaring it
+     * mid-pageview re-DENIES what that grant allowed until the update lands.
+     * This snippet is reached only where the gate already said yes, so it
+     * states the update and leaves the default to whoever mounts first.
+     *
+     * `ad_user_data` and `ad_personalization` travel with `ad_storage`:
+     * Consent Mode v2 treats them as separate signals, and an update setting
+     * only storage leaves the other two at the library's default on every
+     * EEA request.
+     */ 'window.dataLayer=window.dataLayer||[];' + 'function gtag(){dataLayer.push(arguments);}' + "gtag('consent','update',{ad_storage:'granted'," + "ad_user_data:'granted',ad_personalization:'granted'});" + "gtag('js', new Date());" + `gtag('config', '${accountId}');`,
+    setConsent: (scope, granted)=>{
+        try {
+            const gtag = scope.gtag;
+            if (typeof gtag === 'function') {
+                ;
+                gtag('consent', 'update', {
+                    ad_storage: granted ? 'granted' : 'denied',
+                    ad_user_data: granted ? 'granted' : 'denied',
+                    ad_personalization: granted ? 'granted' : 'denied'
+                });
+            }
+        } catch (unused) {
+        // A tag that throws on its own consent call is one we cannot silence
+        // that way; the element removal and the cookie sweep still stand.
+        }
+    }
+};
+/**
+ * LinkedIn Insight Tag.
+ *
+ * ## Cookies, and why the prefix list is long
+ *
+ * LinkedIn writes more names than the other two and they do not share a stem:
+ * `li_sugr` and `UserMatchHistory` are the retargeting identifiers, `bcookie`
+ * and `lidc` are set on the `.linkedin.com` domain by the loader, and
+ * `AnalyticsSyncHistory` records the last sync. A prefix list that named only
+ * `li_` would leave three of them behind on withdrawal — the AGL-2486 shape,
+ * where a sweep looks thorough because it cleared the ones that happen to
+ * share a prefix.
+ *
+ * ⚠️ `bcookie` and `lidc` are written at `.linkedin.com`, a domain a page on
+ * our origin cannot delete through `document.cookie`. The sweep removes what
+ * it can reach and the element removal stops the tag writing more; the rest is
+ * LinkedIn's to hold, and saying so is better than a sweep that quietly
+ * half-works.
+ */ export const LINKEDIN_INSIGHT_VENDOR = {
+    id: 'linkedin',
+    label: 'LinkedIn Insight Tag',
+    accountIdPattern: LINKEDIN_PARTNER_ID_PATTERN,
+    scriptSrc: 'https://snap.licdn.com/li.lms-analytics/insight.min.js',
+    scriptMatch: 'snap.licdn.com',
+    cookiePrefixes: [
+        'li_sugr',
+        'UserMatchHistory',
+        'AnalyticsSyncHistory',
+        'bcookie',
+        'lidc',
+        'li_gc'
+    ],
+    bootSnippet: (accountId)=>// The Insight Tag reads its partner id off a global array the library
+        // drains on load, so the id is pushed before the script is appended
+        // rather than passed to it.
+        `window._linkedin_partner_id='${accountId}';` + 'window._linkedin_data_partner_ids=window._linkedin_data_partner_ids||[];' + 'window._linkedin_data_partner_ids.push(window._linkedin_partner_id);',
+    setConsent: (scope, granted)=>{
+        try {
+            // The tag has no consent API of its own. What it does have is the
+            // partner-id array it drains on load: emptying it stops a late or
+            // re-inserted library finding an id to report against. The element
+            // removal and the cookie sweep remain the substance.
+            if (!granted) scope._linkedin_data_partner_ids = [];
+        } catch (unused) {
+        // Same standing as the others: the teardown does not depend on this.
+        }
+    }
+};
+/**
+ * Every vendor this gate knows how to tear down — which is a SUPERSET of the
+ * vendors it knows how to load, now that a sweep-only member exists.
+ */ export const ADVERTISING_VENDORS = [
+    META_PIXEL_VENDOR,
+    GOOGLE_ADS_VENDOR,
+    LINKEDIN_INSIGHT_VENDOR
+];
+/**
+ * The whole verdict: which advertising tags may exist in this document, for
+ * this visitor, on this site, right now?
+ *
+ * Pure, and empty is the answer to every question it cannot answer — an absent
+ * host, an unreadable record, an unknown vendor id, a malformed account id.
+ * See the module comment for the six conditions and why each one is separate.
+ *
+ * `stored` is the CLIENT-resolved record. Like the GA gate, this is evaluated
+ * after hydration only: tenant pages are ISR-cached, so the server HTML must
+ * be identical for every visitor and cannot carry a tag one of them granted.
+ *
+ * `internal` is read the same way and for the same reason. Taking it as a
+ * defaulted parameter rather than calling into the browser mid-verdict is what
+ * keeps this function testable in both directions — a gate that can only be
+ * exercised one way is the shape that ships broken (AGL-2067).
+ */ export function resolveAdvertisingTags(host, stored, env = readAnalyticsEnvironment(), internal = readInternalTrafficOverride()) {
+    var _host_analytics;
+    if (isPlatformMarketingHost(host) === false) return [];
+    if (analyticsMayEmit(env) === false) return [];
+    if (hostConsentRequired(host) === false) return [];
+    if (advertisingGrantedByRecord(host, stored) === false) return [];
+    // Condition 6. Structural, like every other clause here: the tag is not
+    // mounted rather than mounted-and-suppressed, because a resident tag fires
+    // on its own and a `_gcl_*` cookie is written by the first automatic event.
+    //
+    // The environment half is not redundant with `analyticsMayEmit` above. That
+    // clause passes under the non-production escape hatch, and a build emitting
+    // because someone asked it to is ours by definition — so the hatch must not
+    // hand a dev or preview build the real `AW-` id and let it build remarketing
+    // audiences out of our own engineers, which is the hole condition 2 exists
+    // to close. Same reasoning as `INTERNAL_TRAFFIC_FORCED_SNIPPET`.
+    if (internal === true) return [];
+    if (analyticsEnvironmentForcesInternal(env) === true) return [];
+    const configured = host == null ? void 0 : (_host_analytics = host.analytics) == null ? void 0 : _host_analytics.adTags;
+    if (!configured) return [];
+    const tags = [];
+    for (const vendor of ADVERTISING_VENDORS){
+        var _configured_vendor_id;
+        // Sweep-only: nothing to mount, and no `accountIdPattern` to test with.
+        // Skipped explicitly rather than left to fail a pattern check, so a stray
+        // `adTags['google-ads']` cannot conjure a script (AGL-2486).
+        if (vendor.sweepOnly || !vendor.accountIdPattern) continue;
+        const accountId = String((_configured_vendor_id = configured[vendor.id]) != null ? _configured_vendor_id : '');
+        if (vendor.accountIdPattern.test(accountId)) {
+            tags.push({
+                vendor,
+                accountId
+            });
+        }
+    }
+    return tags;
+}
+/**
+ * The script elements THIS MODULE put in the document for a given vendor —
+ * both the inline boot and the library, since a vendor mounts as a pair.
+ *
+ * Scoped by {@link ADVERTISING_TAG_ATTRIBUTE}, which is the clause that keeps
+ * a pixel a customer pasted into their own Custom HTML out of our teardown.
+ * An element that carries the attribute but whose `src` points somewhere other
+ * than this vendor is excluded as well: the attribute is ours to write, so a
+ * mismatch means something rewrote it and the safe reading is "not ours".
+ * An element with NO `src` is the inline boot and passes — it has no URL to
+ * disagree with.
+ */ function markedVendorElements(vendor) {
+    if (typeof document === 'undefined') return [];
+    // A sweep-only vendor has no script of ours and therefore no element that
+    // could be "ours" (AGL-2486). Returning early is also what stops an absent
+    // `scriptMatch` reaching `src.includes(...)` below — an empty string there
+    // would have matched EVERY marked script, handing one vendor's teardown
+    // another vendor's elements.
+    if (vendor.sweepOnly || !vendor.scriptMatch) return [];
+    try {
+        const selector = `script[${ADVERTISING_TAG_ATTRIBUTE}="${vendor.id}"]`;
+        return Array.from(document.querySelectorAll(selector)).filter((element)=>{
+            var _element_src;
+            const src = String((_element_src = element.src) != null ? _element_src : '');
+            return src === '' || src.includes(vendor.scriptMatch);
+        });
+    } catch (unused) {
+        // A hostile or absent DOM: nothing we can prove is ours.
+        return [];
+    }
+}
+/** Every vendor whose tag this module loaded and that is still resident. */ export function residentAdvertisingVendors() {
+    return ADVERTISING_VENDORS.filter((vendor)=>markedVendorElements(vendor).length > 0);
+}
+/**
+ * Stop every advertising tag THIS MODULE loaded, and return the vendor ids it
+ * acted on — which is what makes the withdrawal assertable rather than
+ * assumed.
+ *
+ * Three steps, in this order and for these reasons:
+ *
+ * 1. **Revoke on the resident tag.** The gate cannot unload a script that has
+ *    already executed. This is the vendor's own kill switch and it is what
+ *    actually stops the next automatic event.
+ * 2. **Remove the script elements.** So the structural property the gate
+ *    asserts — the vendor's script is not in this document — is restored and
+ *    not merely claimed. React unmounting its `<Script>` does not reliably do
+ *    this: `next/script` injects into the head and leaves it there.
+ * 3. **Sweep the cookies.** Last, because steps 1 and 2 are what stop them
+ *    coming straight back (AGL-1608).
+ *
+ * Acts only on tags carrying {@link ADVERTISING_TAG_ATTRIBUTE}. On a customer
+ * site — where this module never loaded anything — it is a no-op that touches
+ * no cookie, which is the only correct behaviour: their pixel, if any, runs on
+ * a basis that is not ours to withdraw.
+ */ export function revokeAdvertisingTags(hostname) {
+    if (typeof window === 'undefined') return [];
+    const acted = [];
+    const scope = window;
+    for (const vendor of ADVERTISING_VENDORS){
+        /*
+     * The element check is an OWNERSHIP test (AGL-1498 case (e)).
+     *
+     * A pixel we did not load is one running on a basis that is not ours to
+     * withdraw — a customer's own Custom HTML, on their own site, under their
+     * own notice. Killing it, or clearing its cookies, would be us
+     * reconfiguring their site against a consent record their tag never ran
+     * on. So no marker of ours means hands off, cookies included.
+     *
+     * `alwaysSweep` is the narrow exception and it is about the COOKIE, not
+     * the loader: `_gcl_*` is written by any Google tag — a GTM container, a
+     * bare gtag — with no marker of ours ever existing, which is why it
+     * survived every withdrawal until AGL-2486. Giving Google a loader must
+     * not quietly take that sweep away again.
+     *
+     * ORDER, which is the whole of AGL-1608: revoke on the tag FIRST, then
+     * remove it, then sweep. Sweeping first deletes the cookies and the
+     * resident pixel's next automatic event writes them straight back inside
+     * the same pageview.
+     */ const elements = vendor.sweepOnly ? [] : markedVendorElements(vendor);
+        const ours = elements.length > 0;
+        if (ours) {
+            vendor.setConsent == null ? void 0 : vendor.setConsent.call(vendor, scope, false);
+            for (const element of elements){
+                try {
+                    element.remove();
+                } catch (unused) {
+                // A detached or frozen node: the revoke above still stands.
+                }
+            }
+        }
+        const maySweep = ours || vendor.sweepOnly || vendor.alwaysSweep;
+        const swept = maySweep ? clearCookiesWithPrefixes(vendor.cookiePrefixes, hostname) : [];
+        if (ours || swept.length > 0) acted.push(vendor.id);
+    }
+    return acted;
+}
+/**
+ * Re-grant on a tag that is still resident — the symmetric half.
+ *
+ * A visitor who withdraws and changes their mind inside one pageview would
+ * otherwise stay silently un-tracked until they navigated, because a re-
+ * rendered `<Script>` cannot re-execute a library the browser already ran.
+ * `setResidentAnalyticsTags` is symmetric for exactly this reason and this is
+ * the same move for a second channel.
+ *
+ * Returns the vendor ids it reached; empty when nothing is resident, which is
+ * the normal case — a re-grant after the elements were removed goes through
+ * the gate and loads a fresh tag instead.
+ */ export function restoreAdvertisingTags() {
+    if (typeof window === 'undefined') return [];
+    const scope = window;
+    const acted = [];
+    for (const vendor of residentAdvertisingVendors()){
+        vendor.setConsent == null ? void 0 : vendor.setConsent.call(vendor, scope, true);
+        acted.push(vendor.id);
+    }
+    return acted;
+}
+
+//# sourceMappingURL=advertising-tags.js.map

package/src/lib/app-utils/advertising-tags.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/advertising-tags.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The VENDOR-AGNOSTIC advertising-tag gate.\n *\n * ## The hole this closes\n *\n * Until now the consent machinery could gate exactly one thing: Google. The\n * `advertising` category has existed since AGL-1649 and it is honest — a\n * refusal always wins, and a host that never asked gets nothing — but the\n * only ENFORCEMENT it ever reached was {@link consentModeSignals}, four\n * strings handed to `gtag`. A non-Google tag could not be consent-gated at\n * all, because nothing in the repo knew how to gate one. Deciding to deploy a\n * Meta Pixel with that as the state of the art would have meant either\n * shipping it ungated or inventing a second consent implementation beside the\n * first — the outcome AGL-1579 explicitly ruled out.\n *\n * This module is the missing enforcement channel, built for vendors in\n * general and populated with one descriptor. **Deploying the Meta Pixel is a\n * separate decision and this module does not take it** — see \"What is NOT\n * wired\" below.\n *\n * ## Why the gate is STRUCTURAL\n *\n * The lesson AGL-1498 paid for and AGL-1608 paid for again: a boolean checked\n * before each call is not a gate. A resident tag fires on its own — GA4\n * enhanced measurement re-created `_ga_YW5PG16YTM` on aglyn.com after a\n * hand-run sweep to zero cookies, from one scroll to the footer — so the only\n * enforcement that holds is the tag never being in the document.\n *\n * So the shape here mirrors the GA gate exactly:\n *\n * - {@link resolveAdvertisingTags} is a PURE verdict over the host document\n *   and the visitor's stored record. It returns the tags that may exist. An\n *   ungranted visitor gets an empty array, the component renders no\n *   `<Script>`, and no request goes to the vendor. Not loaded-then-suppressed:\n *   not loaded.\n * - {@link revokeAdvertisingTags} exists because the gate CANNOT unload a tag.\n *   Dropping the element on a mid-pageview withdrawal leaves the vendor's\n *   script executing, so withdrawal additionally revokes consent on the\n *   resident tag, removes its script elements, and sweeps its cookies — in\n *   that order, for the AGL-1608 reason: sweeping first deletes the cookies\n *   and immediately gets them back.\n *\n * ## The six conditions, all independent, all required\n *\n * 1. **{@link isPlatformMarketingHost}** — Aglyn's own marketing site, never a\n *    customer's. This is the DPA §3.2 boundary: Aglyn promises customers it\n *    does not \"sell\"/\"share\" Customer Personal Data, and an ad pixel on a\n *    customer's published site — or in the console — would breach that. Note\n *    the console needs no condition of its own: it does not render the tenant\n *    runtime's analytics component at all, so there is no mount point to gate.\n * 2. **{@link analyticsMayEmit}** — a real production deployment. AGL-2067's\n *    finding was that `next dev` and Vercel PREVIEW builds resolve\n *    `aglyn.com`'s host document exactly as production does; without this a\n *    preview deploy would build real retargeting audiences out of our own\n *    engineers.\n * 3. **{@link hostConsentRequired}** — the consent machinery is actually live\n *    for this site. A host that switched the tool off (`consent.disabled`)\n *    runs their own CMP and ours has no answer on file to act on.\n * 4. **{@link advertisingGrantedByRecord}** — the host asks about advertising\n *    AND the visitor explicitly said yes to that specific category. This is\n *    where the region behaviour is INHERITED rather than reimplemented: an\n *    EEA/UK visitor pre-choice has no record, an unknown-region visitor has no\n *    record, a US `implied` visitor's status cannot carry an advertising\n *    grant, and `gpc-opt-out` cannot either. There is deliberately no country\n *    logic in this file.\n * 5. **A configured, well-formed account id for a KNOWN vendor.** The gate\n *    describes what may load; the host document decides what is configured.\n * 6. **{@link readInternalTrafficOverride} is false** — this browser has not\n *    been declared one of ours. A GA4 data filter is PROPERTY-scoped: it drops\n *    `traffic_type: internal` hits from the GA4 property and has no reach into\n *    an `AW-`/Meta/LinkedIn destination at all, which are separate products\n *    reached by separate requests. Measured on `aglyn.com`: a flagged browser's\n *    pageview is correctly absent from GA4 while the same pageview still sends\n *    `ccm/collect`, `pagead/1p-user-list` (`is_vtc=1`) and\n *    `viewthroughconversion` to Google Ads, joining our own staff to the\n *    remarketing audiences those requests build. Excluding ourselves from the\n *    reports while still training the bidding on ourselves is the worse half of\n *    the problem, because it is the half nobody can see in a report.\n *\n *    This is the same browser-scoped opt-in the GA4 stamp uses, so one visit to\n *    `?aglyn_internal=1` covers both, and the two cannot drift apart into a\n *    browser that is internal for one product and external for the other. Note\n *    it is the BROWSER, not the account: staff ID-token claims are the console\n *    mechanism (AGL-1582) and there is no account to consult here.\n *\n *    {@link analyticsEnvironmentForcesInternal} is the other half of the same\n *    condition. Condition 2 passes under the non-production escape hatch, and a\n *    build that emits because someone asked it to is ours by definition — so\n *    the hatch must not hand a dev or preview build the real `AW-` id. Without\n *    this the hatch reopens precisely the hole condition 2 closes, which is why\n *    `INTERNAL_TRAFFIC_FORCED_SNIPPET` exists on the GA side.\n *\n * ## What is NOT wired, and why that is the point\n *\n * No host document carries an `analytics.adTags` entry. The Meta descriptor\n * below is a description of how that vendor would be loaded and — more\n * importantly — how it would be torn down; it is inert until someone writes a\n * pixel id onto the `aglyn-marketing` host. That makes deployment a DATA\n * change reviewed on its own merits, exactly as configuring GA is, rather than\n * something that rides along with this mechanism.\n *\n * ## Why customer sites are excluded outright rather than offered this\n *\n * A customer-facing \"run your own ad pixel\" feature is a different product\n * decision with its own consent copy, its own cookie-policy rows and its own\n * DPA implications. Nothing here forecloses it. What this module must not do\n * is arrive as that feature by accident.\n */\n\nimport {\n  GOOGLE_ADS_ID_PATTERN,\n  LINKEDIN_PARTNER_ID_PATTERN,\n  META_PIXEL_ID_PATTERN,\n} from './visitor-consent'\nimport {\n  analyticsEnvironmentForcesInternal,\n  analyticsMayEmit,\n  type AnalyticsEnvironment,\n  readAnalyticsEnvironment,\n} from './analytics-environment'\nimport { readInternalTrafficOverride } from './internal-traffic'\nimport { isPlatformMarketingHost } from './platform-marketing-host'\nimport {\n  ADVERTISING_COOKIE_PREFIXES,\n  advertisingGrantedByRecord,\n  clearCookiesWithPrefixes,\n  hostConsentRequired,\n  type StoredVisitorConsent,\n  type VisitorConsentHost,\n} from './visitor-consent'\n\n/**\n * The attribute every script element this module renders carries.\n *\n * Load-bearing for the teardown, not decoration. {@link revokeAdvertisingTags}\n * acts ONLY on elements carrying it, so a vendor tag a customer pasted into\n * their own site's Custom HTML is never touched by our withdrawal path — we\n * did not load it, we do not know what basis it runs on, and silently killing\n * it would be us configuring a customer's site. Its value is the vendor id.\n */\nexport const ADVERTISING_TAG_ATTRIBUTE = 'data-aglyn-ad-tag'\n\n/**\n * One advertising vendor, described completely enough to LOAD it and — the\n * half that is easy to forget and impossible to retrofit — to STOP it.\n *\n * Every field exists because withdrawal needs it. A vendor that cannot be\n * revoked, whose script cannot be found in the document, and whose cookies are\n * not named, cannot be consent-gated at all; requiring the descriptor to\n * answer all three is what stops a future vendor being added load-only.\n *\n * TWO SHAPES, since AGL-2486. A vendor we MOUNT answers all three and every\n * field below is required of it. A {@link AdvertisingVendor.sweepOnly} vendor\n * answers only the third, because there is no script of ours to find or stop —\n * its cookies are a side effect of a tag another module owns. The mount fields\n * are therefore optional at the type level and mandatory in practice for\n * anything without that flag, which `advertising-tag-gate.spec.tsx` asserts.\n * `cookiePrefixes` stays required of BOTH: naming the cookies is the one thing\n * no vendor is excused from, and it is what the Cookie Policy is written from.\n */\nexport interface AdvertisingVendor {\n  /** Stable key: the `analytics.adTags` map key and the attribute value. */\n  readonly id: string\n  /** Human name, for the cookie policy and the consent copy. */\n  readonly label: string\n  /**\n   * A vendor this module never LOADS — its cookies are a side effect of a tag\n   * some other module owns (today: the GA4 gtag that `site-analytics.tsx`\n   * mounts, which writes `_gcl_*` once `ad_storage` is granted). AGL-2486.\n   *\n   * It is a member of this registry because the registry's job is every\n   * advertising artifact that touches the browser, and because the disclosure\n   * guard in `cookie-inventory.spec.ts` keys on `cookiePrefixes` — a vendor\n   * missing from here is a vendor missing from the Cookie Policy. Meta being\n   * present while Google was absent is the asymmetry that produced the gap.\n   *\n   * Such a vendor declares `id`, `label` and `cookiePrefixes` and NOTHING\n   * else: there is no script to mount, none to remove, and no vendor-specific\n   * consent call — GA's own consent-mode signals carry the state. The mount\n   * fields below are therefore optional, and `advertising-tag-gate.spec.tsx`\n   * asserts every vendor WITHOUT this flag still declares all of them, so the\n   * original invariant — a vendor that cannot be revoked cannot be gated —\n   * survives for everything that does load.\n   */\n  readonly sweepOnly?: true\n  /**\n   * Sweep this vendor's cookies even when no marked element is present.\n   *\n   * The element check is an OWNERSHIP test, not a liveness one: a pixel we did\n   * not load is a pixel running on a basis that is not ours to withdraw, so\n   * its cookies are not ours to clear either. `alwaysSweep` is for a vendor\n   * whose cookies cannot belong to anybody else's tag on our surfaces —\n   * Google's `_gcl_*`, which a GTM container or a bare gtag writes without any\n   * marker of ours ever existing. That is the AGL-2486 case, and it is a\n   * property of the COOKIE rather than of the loader.\n   */\n  readonly alwaysSweep?: true\n  /**\n   * Strict format check on the configured account id. The id lands inside an\n   * inline script, so this is load-bearing exactly as\n   * `GA_MEASUREMENT_ID_PATTERN` is (the AGL-138 concern).\n   */\n  readonly accountIdPattern?: RegExp\n  /** The vendor library URL. Constant — no interpolation reaches it. */\n  readonly scriptSrc?: string\n  /**\n   * The library URL for a vendor whose LOADER carries the account id.\n   *\n   * Most vendors take their id in the boot snippet and fetch a constant URL,\n   * which is what {@link scriptSrc} is. `gtag.js` is the exception: Google's\n   * documented install is `gtag/js?id=<account>`, and the id in the query is\n   * what tells the loader which container's configuration to fetch. Without\n   * it the library still returns 200 and still defines `gtag()`, so nothing\n   * anywhere reports an error — it simply registers no container, and every\n   * `config` for the account queues against a runtime that will never serve\n   * it. Measured on `app.aglyn.com` (AGL-2559): the bare loader left\n   * `google_tag_data.tidr.container` holding the GA4 id and an EMPTY string,\n   * with no request to `googleadservices` at all.\n   *\n   * Present, it wins over {@link scriptSrc}. `scriptSrc` stays the vendor's\n   * base URL, because it is what {@link sharesLibrary}, {@link scriptMatch}\n   * and the CSP origin list are all matched against, and none of those may\n   * vary per account.\n   *\n   * The id reaching a URL is the same load-bearing check as the id reaching an\n   * inline script: it is interpolated only after `accountIdPattern` passed.\n   */\n  readonly scriptSrcFor?: (accountId: string) => string\n  /**\n   * A substring of a library URL this vendor SHARES with another loader.\n   *\n   * Set it and the tag mounts its boot snippet but skips its own `<script>`\n   * when a matching one is already in the document. Google Ads is the case:\n   * `gtag.js` is the same library the GA4 measurement id loads, so a site with\n   * both configured would fetch it twice, define `gtag()` twice, and — the\n   * part that actually corrupts data — push a second `consent default` that\n   * re-denies what the first one granted, mid-pageview.\n   *\n   * The boot snippet still runs, because a `config` for a SECOND product is\n   * exactly how gtag is meant to carry two: one library, two configs, no\n   * double count.\n   */\n  readonly sharesLibrary?: string\n  /**\n   * Substring that identifies a RESIDENT script element for this vendor,\n   * used together with {@link ADVERTISING_TAG_ATTRIBUTE} at teardown.\n   */\n  readonly scriptMatch?: string\n  /** Cookie-name prefixes this vendor sets, swept on withdrawal. */\n  readonly cookiePrefixes: readonly string[]\n  /** The inline boot snippet, built from a FORMAT-CHECKED account id. */\n  readonly bootSnippet?: (accountId: string) => string\n  /**\n   * Tell a RESIDENT tag what the visitor decided. The vendor's own documented\n   * opt-out mechanism — the `ga-disable-<id>` analogue — reached through\n   * whatever global it left behind. Called in both directions, so a visitor\n   * who withdraws and changes their mind in one pageview is not silently\n   * unmeasured until they navigate.\n   */\n  readonly setConsent?: (\n    scope: Record<string, unknown>,\n    granted: boolean,\n  ) => void\n}\n\n\n/**\n * Meta (Facebook/Instagram) Pixel.\n *\n * ## What happens to `_fbp` / `_fbc` on withdrawal: they are DELETED\n *\n * Not merely stopped. The decision is inherited, not invented: AGL-1606\n * settled that a withdrawal \"cleans up, it does not merely stop adding\" for\n * the GA equivalents, and there is no honest reading under which Meta's\n * first-party identifiers get a softer rule than Google's. Both are\n * browser-lifetime identifiers written by an advertising tag under a consent\n * the visitor has just withdrawn.\n *\n * They are swept with the SAME ladder as `_ga` — the exact hostname and every\n * domain up to the registrable one — because Meta writes them the same way GA\n * does: path `/`, first-party, at the registrable domain. A deletion aimed at\n * the exact hostname would silently no-op.\n *\n * Two limits, stated rather than glossed. Any copy Meta already ingested is\n * gone from our reach — deletion stops future joins, it does not retract past\n * ones; the CPRA opt-out title on the control is about the ongoing \"share\",\n * which this does stop. And a cookie written at a path other than `/` is not\n * reachable through `document.cookie`; Meta does not write one.\n *\n * ## Why `consent revoke` is called BEFORE the sweep\n *\n * `fbq('consent', 'revoke')` is Meta's documented CMP control and the exact\n * counterpart of the `ga-disable-<id>` flag. Skipping it and going straight to\n * the cookies reproduces AGL-1608: the resident pixel's next automatic event\n * re-writes `_fbp` and the sweep un-does itself inside the same pageview.\n */\nexport const META_PIXEL_VENDOR: AdvertisingVendor = {\n  id: 'meta',\n  label: 'Meta Pixel',\n  // Meta pixel ids are numeric; the length band is generous on both sides\n  // rather than pinned to today's 15-16 digits.\n  accountIdPattern: META_PIXEL_ID_PATTERN,\n  scriptSrc: 'https://connect.facebook.net/en_US/fbevents.js',\n  scriptMatch: 'connect.facebook.net',\n  cookiePrefixes: ['_fbp', '_fbc'],\n  bootSnippet: (accountId: string) =>\n    // Meta's own shim, then an EXPLICIT grant, then init. The explicit grant\n    // is the AGL-1622 move applied to this vendor: the tag's first hit should\n    // carry a state someone actually chose rather than the vendor's built-in\n    // default, and declaring it before `init` means the automatic PageView is\n    // already covered by it. Reached only where the gate said yes.\n    \"!function(f,b,e,v,n,t,s){if(f.fbq)return;n=f.fbq=function(){n.callMethod?\" +\n    \"n.callMethod.apply(n,arguments):n.queue.push(arguments)};\" +\n    \"if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0';n.queue=[]}\" +\n    '(window,document);' +\n    \"fbq('consent', 'grant');\" +\n    `fbq('init', '${accountId}');` +\n    \"fbq('track', 'PageView');\",\n  setConsent: (scope: Record<string, unknown>, granted: boolean) => {\n    try {\n      const fbq = scope.fbq\n      if (typeof fbq === 'function') {\n        ;(fbq as (...args: unknown[]) => void)(\n          'consent',\n          granted ? 'grant' : 'revoke',\n        )\n      }\n    } catch {\n      // A tag that throws on its own consent call is one we cannot silence\n      // that way; the element removal and the cookie sweep still stand.\n    }\n  },\n}\n\n/**\n * Google advertising storage — a SWEEP-ONLY vendor (AGL-2486).\n *\n * There is no Google ad script for this module to load. `_gcl_*` and `_gac_*`\n * are written by the GA4 gtag that `site-analytics.tsx` already mounts, once\n * the visitor's `ad_storage` is granted. So the tag is somebody else's to\n * mount and somebody else's to signal; what belongs here is the half nobody\n * owned, which is the cookies.\n *\n * `_gcl_au` is the specific reason this exists. It does not begin with `_ga`,\n * so {@link ANALYTICS_COOKIE_PREFIXES} never reached it, and `revokeAdvertisingTags`\n * could not either — that function acts on marked script ELEMENTS, and there\n * has never been one for Google. The cookie therefore survived every\n * withdrawal on every surface. See {@link ADVERTISING_COOKIE_PREFIXES} for why\n * the prefix is `_gcl` ALONE and cannot reach `_ga`/`_gid`.\n *\n * ⚠️ `_gac` is NOT in that list and must not be added back. It is written\n * under the analytics loader, sits in the `Google Analytics` row of\n * `apps/console/constants/cookie-inventory.ts`, and is already swept by the\n * `_ga` prefix; `advertising-cookie-sweep.spec.ts` pins it as analytics-owned.\n * An earlier version of this comment named it here, and a published Cookie\n * Policy line describing `_gac` as advertising-gated traces to exactly that.\n *\n * The prefixes are IMPORTED rather than restated. They are consumed in two\n * places — the universal sweep in `storeVisitorConsent` and the element-scoped\n * one below — and a second copy would be a second thing to forget.\n */\nexport const GOOGLE_ADS_VENDOR: AdvertisingVendor = {\n  id: 'google-ads',\n  label: 'Google advertising',\n  /*\n   * A LOADER now, not sweep-only (AGL-1152).\n   *\n   * It was sweep-only because Google's ad tags arrived through something else\n   * — a GA4 id or a GTM container — so there was nothing of ours to mount and\n   * only cookies to clear. That made advertising reachable ONLY through an\n   * analytics product: a site that wanted Google Ads and no analytics had no\n   * route at all, and the CSP gate that reads `adTags` never opened for it.\n   *\n   * `gtag.js` with an `AW-` id is Google's own documented install for Ads\n   * without Analytics. The same library serves both products; what differs is\n   * the id it is configured with, which is why the two patterns are separate\n   * and neither field accepts the other's.\n   */\n  accountIdPattern: GOOGLE_ADS_ID_PATTERN,\n  // Keeps the AGL-2486 sweep it had as a sweep-only vendor: `_gcl_*` is\n  // written by any Google tag, including ones we never marked.\n  alwaysSweep: true,\n  scriptSrc: 'https://www.googletagmanager.com/gtag/js',\n  // The loader carries the account, because gtag resolves the container from\n  // the query rather than from the `config` that follows. See `scriptSrcFor`;\n  // reached only when `sharesLibrary` did NOT find a loader to ride.\n  scriptSrcFor: (accountId: string) =>\n    `https://www.googletagmanager.com/gtag/js?id=${accountId}`,\n  // The GA4 measurement id loads this exact library. See `sharesLibrary`.\n  sharesLibrary: 'googletagmanager.com/gtag/js',\n  scriptMatch: 'googletagmanager.com/gtag/js',\n  cookiePrefixes: ADVERTISING_COOKIE_PREFIXES,\n  bootSnippet: (accountId: string) =>\n    /*\n     * DENIED FIRST, then granted — the AGL-1622 order.\n     *\n     * `gtag('consent', 'default', …)` has to run before the config, or the\n     * library's own default applies to the first hit. This snippet is reached\n     * only where the gate already said yes, so the grant follows immediately;\n     * declaring the default anyway is what makes the first hit carry a state\n     * somebody chose rather than Google's.\n     *\n     * `ad_user_data` and `ad_personalization` are named alongside\n     * `ad_storage`: Consent Mode v2 treats them as separate signals, and a\n     * grant that sets only storage leaves the other two at the library's\n     * default on every EEA request.\n     */\n    /*\n     * NO `consent default` here, deliberately.\n     *\n     * A default is a page-level declaration and something else may already\n     * have made it — the GA4 loader above declares one, and re-declaring it\n     * mid-pageview re-DENIES what that grant allowed until the update lands.\n     * This snippet is reached only where the gate already said yes, so it\n     * states the update and leaves the default to whoever mounts first.\n     *\n     * `ad_user_data` and `ad_personalization` travel with `ad_storage`:\n     * Consent Mode v2 treats them as separate signals, and an update setting\n     * only storage leaves the other two at the library's default on every\n     * EEA request.\n     */\n    'window.dataLayer=window.dataLayer||[];' +\n    'function gtag(){dataLayer.push(arguments);}' +\n    \"gtag('consent','update',{ad_storage:'granted',\" +\n    \"ad_user_data:'granted',ad_personalization:'granted'});\" +\n    \"gtag('js', new Date());\" +\n    `gtag('config', '${accountId}');`,\n  setConsent: (scope: Record<string, unknown>, granted: boolean) => {\n    try {\n      const gtag = scope.gtag\n      if (typeof gtag === 'function') {\n        ;(gtag as (...args: unknown[]) => void)('consent', 'update', {\n          ad_storage: granted ? 'granted' : 'denied',\n          ad_user_data: granted ? 'granted' : 'denied',\n          ad_personalization: granted ? 'granted' : 'denied',\n        })\n      }\n    } catch {\n      // A tag that throws on its own consent call is one we cannot silence\n      // that way; the element removal and the cookie sweep still stand.\n    }\n  },\n}\n\n/**\n * LinkedIn Insight Tag.\n *\n * ## Cookies, and why the prefix list is long\n *\n * LinkedIn writes more names than the other two and they do not share a stem:\n * `li_sugr` and `UserMatchHistory` are the retargeting identifiers, `bcookie`\n * and `lidc` are set on the `.linkedin.com` domain by the loader, and\n * `AnalyticsSyncHistory` records the last sync. A prefix list that named only\n * `li_` would leave three of them behind on withdrawal — the AGL-2486 shape,\n * where a sweep looks thorough because it cleared the ones that happen to\n * share a prefix.\n *\n * ⚠️ `bcookie` and `lidc` are written at `.linkedin.com`, a domain a page on\n * our origin cannot delete through `document.cookie`. The sweep removes what\n * it can reach and the element removal stops the tag writing more; the rest is\n * LinkedIn's to hold, and saying so is better than a sweep that quietly\n * half-works.\n */\nexport const LINKEDIN_INSIGHT_VENDOR: AdvertisingVendor = {\n  id: 'linkedin',\n  label: 'LinkedIn Insight Tag',\n  accountIdPattern: LINKEDIN_PARTNER_ID_PATTERN,\n  scriptSrc: 'https://snap.licdn.com/li.lms-analytics/insight.min.js',\n  scriptMatch: 'snap.licdn.com',\n  cookiePrefixes: [\n    'li_sugr',\n    'UserMatchHistory',\n    'AnalyticsSyncHistory',\n    'bcookie',\n    'lidc',\n    'li_gc',\n  ],\n  bootSnippet: (accountId: string) =>\n    // The Insight Tag reads its partner id off a global array the library\n    // drains on load, so the id is pushed before the script is appended\n    // rather than passed to it.\n    `window._linkedin_partner_id='${accountId}';` +\n    'window._linkedin_data_partner_ids=window._linkedin_data_partner_ids||[];' +\n    'window._linkedin_data_partner_ids.push(window._linkedin_partner_id);',\n  setConsent: (scope: Record<string, unknown>, granted: boolean) => {\n    try {\n      // The tag has no consent API of its own. What it does have is the\n      // partner-id array it drains on load: emptying it stops a late or\n      // re-inserted library finding an id to report against. The element\n      // removal and the cookie sweep remain the substance.\n      if (!granted) scope._linkedin_data_partner_ids = []\n    } catch {\n      // Same standing as the others: the teardown does not depend on this.\n    }\n  },\n}\n\n/**\n * Every vendor this gate knows how to tear down — which is a SUPERSET of the\n * vendors it knows how to load, now that a sweep-only member exists.\n */\nexport const ADVERTISING_VENDORS: readonly AdvertisingVendor[] = [\n  META_PIXEL_VENDOR,\n  GOOGLE_ADS_VENDOR,\n  LINKEDIN_INSIGHT_VENDOR,\n]\n\n/**\n * The host fields this module reads, on top of the consent ones.\n *\n * `adTags` maps a vendor id to that vendor's account id. NO host document\n * carries it today; see the module comment on why deployment is a separate,\n * reviewable data change rather than a consequence of merging this.\n */\nexport interface AdvertisingTagHost extends VisitorConsentHost {\n  analytics?: {\n    gaMeasurementId?: string\n    /** Vendor id → account id. Absent on every site that exists. */\n    adTags?: Record<string, string> | null\n  } | null\n}\n\n/** A vendor that may load, paired with the id it was configured with. */\nexport interface ResolvedAdvertisingTag {\n  readonly vendor: AdvertisingVendor\n  readonly accountId: string\n}\n\n/**\n * The whole verdict: which advertising tags may exist in this document, for\n * this visitor, on this site, right now?\n *\n * Pure, and empty is the answer to every question it cannot answer — an absent\n * host, an unreadable record, an unknown vendor id, a malformed account id.\n * See the module comment for the six conditions and why each one is separate.\n *\n * `stored` is the CLIENT-resolved record. Like the GA gate, this is evaluated\n * after hydration only: tenant pages are ISR-cached, so the server HTML must\n * be identical for every visitor and cannot carry a tag one of them granted.\n *\n * `internal` is read the same way and for the same reason. Taking it as a\n * defaulted parameter rather than calling into the browser mid-verdict is what\n * keeps this function testable in both directions — a gate that can only be\n * exercised one way is the shape that ships broken (AGL-2067).\n */\nexport function resolveAdvertisingTags(\n  host: AdvertisingTagHost | null | undefined,\n  stored: StoredVisitorConsent | null | undefined,\n  env: AnalyticsEnvironment = readAnalyticsEnvironment(),\n  internal: boolean = readInternalTrafficOverride(),\n): ResolvedAdvertisingTag[] {\n  if (isPlatformMarketingHost(host) === false) return []\n  if (analyticsMayEmit(env) === false) return []\n  if (hostConsentRequired(host) === false) return []\n  if (advertisingGrantedByRecord(host, stored) === false) return []\n  // Condition 6. Structural, like every other clause here: the tag is not\n  // mounted rather than mounted-and-suppressed, because a resident tag fires\n  // on its own and a `_gcl_*` cookie is written by the first automatic event.\n  //\n  // The environment half is not redundant with `analyticsMayEmit` above. That\n  // clause passes under the non-production escape hatch, and a build emitting\n  // because someone asked it to is ours by definition — so the hatch must not\n  // hand a dev or preview build the real `AW-` id and let it build remarketing\n  // audiences out of our own engineers, which is the hole condition 2 exists\n  // to close. Same reasoning as `INTERNAL_TRAFFIC_FORCED_SNIPPET`.\n  if (internal === true) return []\n  if (analyticsEnvironmentForcesInternal(env) === true) return []\n  const configured = host?.analytics?.adTags\n  if (!configured) return []\n  const tags: ResolvedAdvertisingTag[] = []\n  for (const vendor of ADVERTISING_VENDORS) {\n    // Sweep-only: nothing to mount, and no `accountIdPattern` to test with.\n    // Skipped explicitly rather than left to fail a pattern check, so a stray\n    // `adTags['google-ads']` cannot conjure a script (AGL-2486).\n    if (vendor.sweepOnly || !vendor.accountIdPattern) continue\n    const accountId = String(configured[vendor.id] ?? '')\n    if (vendor.accountIdPattern.test(accountId)) {\n      tags.push({ vendor, accountId })\n    }\n  }\n  return tags\n}\n\n/**\n * The script elements THIS MODULE put in the document for a given vendor —\n * both the inline boot and the library, since a vendor mounts as a pair.\n *\n * Scoped by {@link ADVERTISING_TAG_ATTRIBUTE}, which is the clause that keeps\n * a pixel a customer pasted into their own Custom HTML out of our teardown.\n * An element that carries the attribute but whose `src` points somewhere other\n * than this vendor is excluded as well: the attribute is ours to write, so a\n * mismatch means something rewrote it and the safe reading is \"not ours\".\n * An element with NO `src` is the inline boot and passes — it has no URL to\n * disagree with.\n */\nfunction markedVendorElements(vendor: AdvertisingVendor): Element[] {\n  if (typeof document === 'undefined') return []\n  // A sweep-only vendor has no script of ours and therefore no element that\n  // could be \"ours\" (AGL-2486). Returning early is also what stops an absent\n  // `scriptMatch` reaching `src.includes(...)` below — an empty string there\n  // would have matched EVERY marked script, handing one vendor's teardown\n  // another vendor's elements.\n  if (vendor.sweepOnly || !vendor.scriptMatch) return []\n  try {\n    const selector = `script[${ADVERTISING_TAG_ATTRIBUTE}=\"${vendor.id}\"]`\n    return Array.from(document.querySelectorAll(selector)).filter((element) => {\n      const src = String((element as HTMLScriptElement).src ?? '')\n      return src === '' || src.includes(vendor.scriptMatch)\n    })\n  } catch {\n    // A hostile or absent DOM: nothing we can prove is ours.\n    return []\n  }\n}\n\n/** Every vendor whose tag this module loaded and that is still resident. */\nexport function residentAdvertisingVendors(): AdvertisingVendor[] {\n  return ADVERTISING_VENDORS.filter(\n    (vendor) => markedVendorElements(vendor).length > 0,\n  )\n}\n\n/**\n * Stop every advertising tag THIS MODULE loaded, and return the vendor ids it\n * acted on — which is what makes the withdrawal assertable rather than\n * assumed.\n *\n * Three steps, in this order and for these reasons:\n *\n * 1. **Revoke on the resident tag.** The gate cannot unload a script that has\n *    already executed. This is the vendor's own kill switch and it is what\n *    actually stops the next automatic event.\n * 2. **Remove the script elements.** So the structural property the gate\n *    asserts — the vendor's script is not in this document — is restored and\n *    not merely claimed. React unmounting its `<Script>` does not reliably do\n *    this: `next/script` injects into the head and leaves it there.\n * 3. **Sweep the cookies.** Last, because steps 1 and 2 are what stop them\n *    coming straight back (AGL-1608).\n *\n * Acts only on tags carrying {@link ADVERTISING_TAG_ATTRIBUTE}. On a customer\n * site — where this module never loaded anything — it is a no-op that touches\n * no cookie, which is the only correct behaviour: their pixel, if any, runs on\n * a basis that is not ours to withdraw.\n */\nexport function revokeAdvertisingTags(hostname?: string | null): string[] {\n  if (typeof window === 'undefined') return []\n  const acted: string[] = []\n  const scope = window as unknown as Record<string, unknown>\n  for (const vendor of ADVERTISING_VENDORS) {\n    /*\n     * The element check is an OWNERSHIP test (AGL-1498 case (e)).\n     *\n     * A pixel we did not load is one running on a basis that is not ours to\n     * withdraw — a customer's own Custom HTML, on their own site, under their\n     * own notice. Killing it, or clearing its cookies, would be us\n     * reconfiguring their site against a consent record their tag never ran\n     * on. So no marker of ours means hands off, cookies included.\n     *\n     * `alwaysSweep` is the narrow exception and it is about the COOKIE, not\n     * the loader: `_gcl_*` is written by any Google tag — a GTM container, a\n     * bare gtag — with no marker of ours ever existing, which is why it\n     * survived every withdrawal until AGL-2486. Giving Google a loader must\n     * not quietly take that sweep away again.\n     *\n     * ORDER, which is the whole of AGL-1608: revoke on the tag FIRST, then\n     * remove it, then sweep. Sweeping first deletes the cookies and the\n     * resident pixel's next automatic event writes them straight back inside\n     * the same pageview.\n     */\n    const elements = vendor.sweepOnly ? [] : markedVendorElements(vendor)\n    const ours = elements.length > 0\n    if (ours) {\n      vendor.setConsent?.(scope, false)\n      for (const element of elements) {\n        try {\n          element.remove()\n        } catch {\n          // A detached or frozen node: the revoke above still stands.\n        }\n      }\n    }\n    const maySweep = ours || vendor.sweepOnly || vendor.alwaysSweep\n    const swept = maySweep\n      ? clearCookiesWithPrefixes(vendor.cookiePrefixes, hostname)\n      : []\n    if (ours || swept.length > 0) acted.push(vendor.id)\n  }\n  return acted\n}\n\n/**\n * Re-grant on a tag that is still resident — the symmetric half.\n *\n * A visitor who withdraws and changes their mind inside one pageview would\n * otherwise stay silently un-tracked until they navigated, because a re-\n * rendered `<Script>` cannot re-execute a library the browser already ran.\n * `setResidentAnalyticsTags` is symmetric for exactly this reason and this is\n * the same move for a second channel.\n *\n * Returns the vendor ids it reached; empty when nothing is resident, which is\n * the normal case — a re-grant after the elements were removed goes through\n * the gate and loads a fresh tag instead.\n */\nexport function restoreAdvertisingTags(): string[] {\n  if (typeof window === 'undefined') return []\n  const scope = window as unknown as Record<string, unknown>\n  const acted: string[] = []\n  for (const vendor of residentAdvertisingVendors()) {\n    vendor.setConsent?.(scope, true)\n    acted.push(vendor.id)\n  }\n  return acted\n}\n"],"names":["GOOGLE_ADS_ID_PATTERN","LINKEDIN_PARTNER_ID_PATTERN","META_PIXEL_ID_PATTERN","analyticsEnvironmentForcesInternal","analyticsMayEmit","readAnalyticsEnvironment","readInternalTrafficOverride","isPlatformMarketingHost","ADVERTISING_COOKIE_PREFIXES","advertisingGrantedByRecord","clearCookiesWithPrefixes","hostConsentRequired","ADVERTISING_TAG_ATTRIBUTE","META_PIXEL_VENDOR","id","label","accountIdPattern","scriptSrc","scriptMatch","cookiePrefixes","bootSnippet","accountId","setConsent","scope","granted","fbq","GOOGLE_ADS_VENDOR","alwaysSweep","scriptSrcFor","sharesLibrary","gtag","ad_storage","ad_user_data","ad_personalization","LINKEDIN_INSIGHT_VENDOR","_linkedin_data_partner_ids","ADVERTISING_VENDORS","resolveAdvertisingTags","host","stored","env","internal","configured","analytics","adTags","tags","vendor","sweepOnly","String","test","push","markedVendorElements","document","selector","Array","from","querySelectorAll","filter","element","src","includes","residentAdvertisingVendors","length","revokeAdvertisingTags","hostname","window","acted","elements","ours","remove","maySweep","swept","restoreAdvertisingTags"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2GC,GAED,SACEA,qBAAqB,EACrBC,2BAA2B,EAC3BC,qBAAqB,QAChB,uBAAmB;AAC1B,SACEC,kCAAkC,EAClCC,gBAAgB,EAEhBC,wBAAwB,QACnB,6BAAyB;AAChC,SAASC,2BAA2B,QAAQ,wBAAoB;AAChE,SAASC,uBAAuB,QAAQ,+BAA2B;AACnE,SACEC,2BAA2B,EAC3BC,0BAA0B,EAC1BC,wBAAwB,EACxBC,mBAAmB,QAGd,uBAAmB;AAE1B;;;;;;;;CAQC,GACD,OAAO,MAAMC,4BAA4B,oBAAmB;AA8H5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BC,GACD,OAAO,MAAMC,oBAAuC;IAClDC,IAAI;IACJC,OAAO;IACP,wEAAwE;IACxE,8CAA8C;IAC9CC,kBAAkBd;IAClBe,WAAW;IACXC,aAAa;IACbC,gBAAgB;QAAC;QAAQ;KAAO;IAChCC,aAAa,CAACC,YACZ,yEAAyE;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,0EAA0E;QAC1E,+DAA+D;QAC/D,8EACA,8DACA,yEACA,uBACA,6BACA,CAAC,aAAa,EAAEA,UAAU,GAAG,CAAC,GAC9B;IACFC,YAAY,CAACC,OAAgCC;QAC3C,IAAI;YACF,MAAMC,MAAMF,MAAME,GAAG;YACrB,IAAI,OAAOA,QAAQ,YAAY;;gBAC3BA,IACA,WACAD,UAAU,UAAU;YAExB;QACF,EAAE,eAAM;QACN,qEAAqE;QACrE,kEAAkE;QACpE;IACF;AACF,EAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BC,GACD,OAAO,MAAME,oBAAuC;IAClDZ,IAAI;IACJC,OAAO;IACP;;;;;;;;;;;;;GAaC,GACDC,kBAAkBhB;IAClB,sEAAsE;IACtE,6DAA6D;IAC7D2B,aAAa;IACbV,WAAW;IACX,2EAA2E;IAC3E,4EAA4E;IAC5E,mEAAmE;IACnEW,cAAc,CAACP,YACb,CAAC,4CAA4C,EAAEA,WAAW;IAC5D,wEAAwE;IACxEQ,eAAe;IACfX,aAAa;IACbC,gBAAgBX;IAChBY,aAAa,CAACC,YACZ;;;;;;;;;;;;;KAaC,GACD;;;;;;;;;;;;;KAaC,GACD,2CACA,gDACA,mDACA,2DACA,4BACA,CAAC,gBAAgB,EAAEA,UAAU,GAAG,CAAC;IACnCC,YAAY,CAACC,OAAgCC;QAC3C,IAAI;YACF,MAAMM,OAAOP,MAAMO,IAAI;YACvB,IAAI,OAAOA,SAAS,YAAY;;gBAC5BA,KAAsC,WAAW,UAAU;oBAC3DC,YAAYP,UAAU,YAAY;oBAClCQ,cAAcR,UAAU,YAAY;oBACpCS,oBAAoBT,UAAU,YAAY;gBAC5C;YACF;QACF,EAAE,eAAM;QACN,qEAAqE;QACrE,kEAAkE;QACpE;IACF;AACF,EAAC;AAED;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,MAAMU,0BAA6C;IACxDpB,IAAI;IACJC,OAAO;IACPC,kBAAkBf;IAClBgB,WAAW;IACXC,aAAa;IACbC,gBAAgB;QACd;QACA;QACA;QACA;QACA;QACA;KACD;IACDC,aAAa,CAACC,YACZ,sEAAsE;QACtE,oEAAoE;QACpE,4BAA4B;QAC5B,CAAC,6BAA6B,EAAEA,UAAU,EAAE,CAAC,GAC7C,6EACA;IACFC,YAAY,CAACC,OAAgCC;QAC3C,IAAI;YACF,kEAAkE;YAClE,kEAAkE;YAClE,mEAAmE;YACnE,qDAAqD;YACrD,IAAI,CAACA,SAASD,MAAMY,0BAA0B,GAAG,EAAE;QACrD,EAAE,eAAM;QACN,qEAAqE;QACvE;IACF;AACF,EAAC;AAED;;;CAGC,GACD,OAAO,MAAMC,sBAAoD;IAC/DvB;IACAa;IACAQ;CACD,CAAA;AAuBD;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,SAASG,uBACdC,IAA2C,EAC3CC,MAA+C,EAC/CC,MAA4BnC,0BAA0B,EACtDoC,WAAoBnC,6BAA6B;QAkB9BgC;IAhBnB,IAAI/B,wBAAwB+B,UAAU,OAAO,OAAO,EAAE;IACtD,IAAIlC,iBAAiBoC,SAAS,OAAO,OAAO,EAAE;IAC9C,IAAI7B,oBAAoB2B,UAAU,OAAO,OAAO,EAAE;IAClD,IAAI7B,2BAA2B6B,MAAMC,YAAY,OAAO,OAAO,EAAE;IACjE,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,EAAE;IACF,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,2EAA2E;IAC3E,iEAAiE;IACjE,IAAIE,aAAa,MAAM,OAAO,EAAE;IAChC,IAAItC,mCAAmCqC,SAAS,MAAM,OAAO,EAAE;IAC/D,MAAME,aAAaJ,yBAAAA,kBAAAA,KAAMK,SAAS,qBAAfL,gBAAiBM,MAAM;IAC1C,IAAI,CAACF,YAAY,OAAO,EAAE;IAC1B,MAAMG,OAAiC,EAAE;IACzC,KAAK,MAAMC,UAAUV,oBAAqB;YAKfM;QAJzB,wEAAwE;QACxE,0EAA0E;QAC1E,6DAA6D;QAC7D,IAAII,OAAOC,SAAS,IAAI,CAACD,OAAO9B,gBAAgB,EAAE;QAClD,MAAMK,YAAY2B,QAAON,wBAAAA,UAAU,CAACI,OAAOhC,EAAE,CAAC,YAArB4B,wBAAyB;QAClD,IAAII,OAAO9B,gBAAgB,CAACiC,IAAI,CAAC5B,YAAY;YAC3CwB,KAAKK,IAAI,CAAC;gBAAEJ;gBAAQzB;YAAU;QAChC;IACF;IACA,OAAOwB;AACT;AAEA;;;;;;;;;;;CAWC,GACD,SAASM,qBAAqBL,MAAyB;IACrD,IAAI,OAAOM,aAAa,aAAa,OAAO,EAAE;IAC9C,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,6BAA6B;IAC7B,IAAIN,OAAOC,SAAS,IAAI,CAACD,OAAO5B,WAAW,EAAE,OAAO,EAAE;IACtD,IAAI;QACF,MAAMmC,WAAW,CAAC,OAAO,EAAEzC,0BAA0B,EAAE,EAAEkC,OAAOhC,EAAE,CAAC,EAAE,CAAC;QACtE,OAAOwC,MAAMC,IAAI,CAACH,SAASI,gBAAgB,CAACH,WAAWI,MAAM,CAAC,CAACC;gBAC1C;YAAnB,MAAMC,MAAMX,QAAO,eAAA,AAACU,QAA8BC,GAAG,YAAlC,eAAsC;YACzD,OAAOA,QAAQ,MAAMA,IAAIC,QAAQ,CAACd,OAAO5B,WAAW;QACtD;IACF,EAAE,eAAM;QACN,yDAAyD;QACzD,OAAO,EAAE;IACX;AACF;AAEA,0EAA0E,GAC1E,OAAO,SAAS2C;IACd,OAAOzB,oBAAoBqB,MAAM,CAC/B,CAACX,SAAWK,qBAAqBL,QAAQgB,MAAM,GAAG;AAEtD;AAEA;;;;;;;;;;;;;;;;;;;;;CAqBC,GACD,OAAO,SAASC,sBAAsBC,QAAwB;IAC5D,IAAI,OAAOC,WAAW,aAAa,OAAO,EAAE;IAC5C,MAAMC,QAAkB,EAAE;IAC1B,MAAM3C,QAAQ0C;IACd,KAAK,MAAMnB,UAAUV,oBAAqB;QACxC;;;;;;;;;;;;;;;;;;;KAmBC,GACD,MAAM+B,WAAWrB,OAAOC,SAAS,GAAG,EAAE,GAAGI,qBAAqBL;QAC9D,MAAMsB,OAAOD,SAASL,MAAM,GAAG;QAC/B,IAAIM,MAAM;YACRtB,OAAOxB,UAAU,oBAAjBwB,OAAOxB,UAAU,MAAjBwB,QAAoBvB,OAAO;YAC3B,KAAK,MAAMmC,WAAWS,SAAU;gBAC9B,IAAI;oBACFT,QAAQW,MAAM;gBAChB,EAAE,eAAM;gBACN,4DAA4D;gBAC9D;YACF;QACF;QACA,MAAMC,WAAWF,QAAQtB,OAAOC,SAAS,IAAID,OAAOnB,WAAW;QAC/D,MAAM4C,QAAQD,WACV5D,yBAAyBoC,OAAO3B,cAAc,EAAE6C,YAChD,EAAE;QACN,IAAII,QAAQG,MAAMT,MAAM,GAAG,GAAGI,MAAMhB,IAAI,CAACJ,OAAOhC,EAAE;IACpD;IACA,OAAOoD;AACT;AAEA;;;;;;;;;;;;CAYC,GACD,OAAO,SAASM;IACd,IAAI,OAAOP,WAAW,aAAa,OAAO,EAAE;IAC5C,MAAM1C,QAAQ0C;IACd,MAAMC,QAAkB,EAAE;IAC1B,KAAK,MAAMpB,UAAUe,6BAA8B;QACjDf,OAAOxB,UAAU,oBAAjBwB,OAAOxB,UAAU,MAAjBwB,QAAoBvB,OAAO;QAC3B2C,MAAMhB,IAAI,CAACJ,OAAOhC,EAAE;IACtB;IACA,OAAOoD;AACT"}