@aglyn/aglyn 1.0.0-beta.143

package/src/lib/app-utils/platform-consent-default.d.ts

@@ -0,0 +1,142 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/** A single consent-mode signal value. */
+export type PlatformConsentSignal = 'granted' | 'denied';
+/**
+ * Switzerland, and why it is here but NOT in the tenant's set.
+ *
+ * Aglyn's own consent brief treats the EEA, the UK **and Switzerland** as
+ * prior opt-in, and none of those regions may be defaulted on. The tenant's
+ * {@link PRIOR_CONSENT_COUNTRY_CODES} does not include `CH` — defensibly, the
+ * revised FADP has no ePrivacy-style prior-consent rule and regulates on a
+ * transparency/opt-out basis — so the two sets genuinely disagree.
+ *
+ * That disagreement is resolved in the only direction that is safe to resolve
+ * unilaterally: Aglyn's OWN surfaces take the stricter reading, and the tenant
+ * set is left exactly as it is. Widening
+ * `PRIOR_CONSENT_COUNTRY_CODES` would flip Swiss visitors on every CUSTOMER
+ * site from tracked to banner-gated — a change to customers' compliance
+ * posture, made on their behalf, which is the specific thing this work is
+ * scoped out of.
+ */
+export declare const PLATFORM_EXTRA_PRIOR_CONSENT_CODES: readonly string[];
+/**
+ * The regions whose analytics default is DENIED on Aglyn's own surfaces.
+ *
+ * DERIVED from the tenant's canonical prior-consent set rather than retyped
+ * beside it. Two hand-maintained country lists is how one of them ends up a
+ * year behind the other, and the failure is silent in both directions: a
+ * missing code tracks a European visitor by default, a stale extra one just
+ * loses data. Deriving means an EU membership change is edited once.
+ *
+ * Sorted so the emitted snippet is byte-stable across builds — the docs
+ * site's copy of it is checked character-for-character.
+ */
+export declare const PLATFORM_PRIOR_CONSENT_REGIONS: readonly string[];
+/**
+ * The four signals a consent-mode declaration carries.
+ *
+ * All four are the full signal type. Pinning the three advertising ones to the
+ * literal `'denied'` made the type a second, silent policy — a declaration that
+ * granted advertising anywhere would not compile, so the surface could never
+ * take an ad tag without someone first noticing the type was the thing
+ * refusing. The policy belongs in the values below, where it can be read.
+ */
+export interface PlatformConsentSignals {
+    analytics_storage: PlatformConsentSignal;
+    ad_storage: PlatformConsentSignal;
+    ad_user_data: PlatformConsentSignal;
+    ad_personalization: PlatformConsentSignal;
+}
+/**
+ * One `gtag('consent', 'default', …)` payload. `region` absent means the
+ * declaration applies wherever no region-scoped one matches.
+ */
+export interface PlatformConsentDefaultCommand extends PlatformConsentSignals {
+    region?: readonly string[];
+}
+/**
+ * The declaration, in emission order.
+ *
+ * The global default comes first and grants analytics — the implied-consent
+ * posture, lawful in the US and most of the world. The region-scoped
+ * declaration follows and denies it for the prior-consent regions. Both are
+ * `default` (never `update`): a default is read before the tag's first hit,
+ * whereas an update arrives after `config` and would leave the session's
+ * first pageview — often the whole session — in the wrong state.
+ */
+export declare const PLATFORM_CONSENT_DEFAULT_COMMANDS: readonly PlatformConsentDefaultCommand[];
+/**
+ * What the declaration above actually MEANS for a visitor in `country`.
+ *
+ * This exists so the defaults can be tested against the thing that ships
+ * rather than against a second copy of the same opinion. It reads
+ * {@link PLATFORM_CONSENT_DEFAULT_COMMANDS} and applies Google's documented
+ * resolution rule — the most specific matching `region` wins, and a
+ * declaration with no `region` is the fallback — so a test that asserts
+ * "DE is denied" fails the moment `DE` stops being in the emitted payload.
+ *
+ * `null`/unknown resolves to the GLOBAL default, which is `granted`. That is
+ * the declaration modelled honestly, not a wish: region matching is done by
+ * Google from the request IP, not by us, so "we do not know the country" is
+ * not a state this mechanism can act on. It is also the one place this module
+ * is weaker than the tenant gate, which resolves unknown-region to opt-in —
+ * another reason the tenant gate is the better mechanism where it can run.
+ */
+export declare function resolvePlatformConsentDefault(country: string | null | undefined): PlatformConsentSignals;
+/**
+ * The declaration as an inline-script snippet.
+ *
+ * Built by serializing {@link PLATFORM_CONSENT_DEFAULT_COMMANDS} — no caller
+ * input reaches it and every value is a literal fixed at module load, which
+ * matters because it lands inside an inline `<script>` (the AGL-138 concern).
+ *
+ * Assumes the canonical `function gtag(){dataLayer.push(arguments);}` shim is
+ * already defined ABOVE it. gtag.js processes `arguments` objects, not plain
+ * arrays, so a `dataLayer.push([...])` here would be the classic silent
+ * no-op: no error, no consent declaration, and nothing in any GA report to
+ * show for it.
+ *
+ * `apps/docs` cannot import from `libs/` (AGL-1595), so the docs site carries
+ * a VERBATIM COPY of this string and
+ * `apps/console/specs/docs-platform-consent-snippet.spec.ts` fails if the two
+ * ever drift — the same treatment `INTERNAL_TRAFFIC_GTAG_SNIPPET` gets, and
+ * for the same reason: a stale copy still runs without error and still reads
+ * like a working declaration.
+ */
+export declare const PLATFORM_CONSENT_DEFAULT_SNIPPET: string;
+/** The `dataLayer`-bearing window this module writes to. */
+export interface ConsentDataLayerWindow {
+    dataLayer?: unknown[];
+}
+/**
+ * Declare the defaults on a window, for surfaces that boot their tag from JS
+ * rather than from an inline script — i.e. the console, whose gtag is
+ * injected by the Firebase Analytics SDK.
+ *
+ * MUST be called before the SDK initializes, because a `default` read after
+ * the tag's `config` is not a default at all. The queue is what makes that
+ * orderable: pushing here lands the declaration in `dataLayer` ahead of
+ * everything gtag.js later processes, even though gtag.js is not loaded yet.
+ *
+ * Pushes a real `arguments` object, never an array literal — see the snippet
+ * note above for what the array form silently does.
+ *
+ * Idempotent per window: a second call is a no-op, so a remount or a
+ * re-entrant services boot cannot stack duplicate declarations.
+ */
+export declare function pushPlatformConsentDefault(win: ConsentDataLayerWindow | null | undefined): boolean;

package/src/lib/app-utils/platform-consent-default.js

@@ -0,0 +1,295 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * The Consent Mode v2 `default` declaration for AGLYN'S OWN surfaces — the
+ * console (`app.aglyn.com`) and the docs site (`docs.aglyn.com`) (AGL-1597).
+ *
+ * the decision, 2026-08-20: analytics is ENABLED BY DEFAULT with implied
+ * consent **where that is lawful**, and denied by default where prior consent
+ * is required. This module is the "where applicable" half, expressed in the
+ * one mechanism that can carry it on a surface with no consent gate: a
+ * region-scoped `gtag('consent', 'default', …)`.
+ *
+ * ## Which surfaces this is for, and — load-bearing — which it is NOT
+ *
+ * Aglyn runs GA4 `G-YW5PG16YTM` on three of its own domains, and they did not
+ * arrive at the same posture:
+ *
+ * - **`aglyn.com`** — served by the TENANT runtime, so it already runs the
+ *   full AGL-1498 gate: a Firestore `consent.mode`, `/api/consent/region`, a
+ *   per-visitor record in localStorage, and a tag that never LOADS for a
+ *   visitor who has not granted. It is already default-on outside the
+ *   prior-consent regions. **This module does not touch it and must not.**
+ *
+ *   ⚠️ Its AD signals DIVERGE from this module's, and that is expected rather
+ *   than a defect — the two domains answer to different rules and always have.
+ *   The history is worth carrying because the divergence has flipped twice:
+ *   AGL-2402 (2026-08-21) let the implied default carry advertising, the
+ *   marketing host had opted into asking, and a US visitor was measured on
+ *   2026-08-23 with the record
+ *   `{"status":"implied","analytics":true,"advertising":true,"country":"US"}`
+ *   and a collect hit carrying `gcs=G111` — ad storage GRANTED. That was
+ *   narrowed back on 2026-08-24 and widened again on 2026-08-25 once the
+ *   Cookie Policy master was rewritten to match the Privacy Policy's opt-out
+ *   description, so the 2026-08-23 measurement is once more the shape the
+ *   current rule produces.
+ *
+ *   This module now takes the SAME advertising posture for `app.aglyn.com`,
+ *   which stopped being the asymmetry it once was once the console grew the
+ *   surfaces an implied grant rests on: a per-visitor record, an account-menu
+ *   control, and the CCPA §7015 pill on the unauthenticated pages. An implied
+ *   grant needs a visitor who COULD have said no, and there they can.
+ *
+ *   `docs.aglyn.com` still cannot ask anybody anything, which is exactly why
+ *   its non-Google advertising tags do not run on this declaration at all —
+ *   they run on the console's record, mirrored across the registrable domain.
+ *   This declaration reaches the tags that read Consent Mode, and nothing
+ *   else does read it.
+ *
+ *   ⛔ Re-measure `aglyn.com` before relying on any comparison here; the
+ *   numbers above are a record of what was seen, not a claim about today.
+ * - **`app.aglyn.com` and `docs.aglyn.com`** — GA loads unconditionally on
+ *   both (no gate can run here), and BEFORE this module they carried no
+ *   consent declaration of any kind. That was not "default on where lawful";
+ *   it was default on EVERYWHERE, prior-consent regions included, which is the
+ *   gap AGL-1597 was filed for. These two are what this module is wired into.
+ *
+ *   On the docs side, being wired in was not enough on its own: the
+ *   declaration was emitted but landed AFTER the gtag preset's `config`, which
+ *   makes it a no-op. See the `ssrTemplate` note in
+ *   `apps/docs/docusaurus.config.ts` — position matters as much as presence.
+ * - **Customer/tenant sites** — NOT in scope by a wide margin. Aglyn ships
+ *   the consent gate to customers as a product (AGL-1498) and the host
+ *   chooses the posture. Changing their default would configure a customer's
+ *   compliance posture for them, for visitors who may well be European. The
+ *   separation here is structural rather than a matter of care: this module
+ *   is imported only by the console's Firebase Analytics boot and copied into
+ *   the docs site's `ssrTemplate` bootstrap. Nothing in the tenant runtime
+ *   reads it, and
+ *   `visitor-consent.ts` — the tenant's decision module — is unchanged.
+ *
+ * ## Why a region-scoped `default` here, and not the tenant's gate
+ *
+ * The tenant gate is strictly stronger: the tag never loads at all for a
+ * gated visitor. It is also unavailable here. It needs a host document, a
+ * per-host storage key and a region endpoint, none of which exist on a static
+ * Docusaurus build or on the console's Firebase-owned tag — and porting it
+ * would be a third implementation of consent, the outcome AGL-1579 explicitly
+ * ruled out. So this is the weaker mechanism applied where the stronger one
+ * cannot reach, and it is strictly better than what it replaces (nothing).
+ *
+ * It is NOT equivalent, and the difference should be stated rather than
+ * glossed: under a denied `analytics_storage` the tag still LOADS and still
+ * sends cookieless pings. That is a real residual question for the EEA/UK,
+ * and it is flagged on AGL-1597 rather than papered over here.
+ *
+ * ## The ad signals
+ *
+ * `ad_storage`, `ad_user_data` and `ad_personalization` are GRANTED in the
+ * global default and DENIED in the region-scoped one, which is the same split
+ * `analytics_storage` takes and for the same reason: outside the prior-consent
+ * regions the posture is implied consent, and Aglyn advertises, remarkets and
+ * retargets across all of its own surfaces. A visitor in the EEA, the UK or
+ * Switzerland gets all four denied until they accept.
+ *
+ * All three signals matter separately and Google treats them separately. A
+ * declaration granting `ad_storage` alone leaves remarketing collecting
+ * nothing while the tag looks perfectly healthy in GA4 — hits are sent, the
+ * property fills up, and the audience stays empty. Read
+ * {@link PLATFORM_CONSENT_DEFAULT_COMMANDS} rather than this paragraph if the
+ * two ever disagree; the commands are what ships.
+ *
+ * The console does have a place to record an answer — a per-visitor record,
+ * an account-menu control and the CCPA §7015 pill on its unauthenticated
+ * pages — and {@link platformAsksAboutAdvertising} derives the question from
+ * these very commands, so the control and the declaration cannot drift apart.
+ * The docs site has neither, which is why the tags it mounts are gated on the
+ * console's record rather than on this declaration; see
+ * `apps/docs/src/advertising-tags.ts`.
+ *
+ * Before this module these surfaces declared nothing at all, which left a
+ * freshly loaded tag with ad storage UNRESTRICTED in every region — so the
+ * region-scoped denial below was a tightening, not a preference.
+ */ import { PRIOR_CONSENT_COUNTRY_CODES } from "./visitor-consent.js";
+/**
+ * Switzerland, and why it is here but NOT in the tenant's set.
+ *
+ * Aglyn's own consent brief treats the EEA, the UK **and Switzerland** as
+ * prior opt-in, and none of those regions may be defaulted on. The tenant's
+ * {@link PRIOR_CONSENT_COUNTRY_CODES} does not include `CH` — defensibly, the
+ * revised FADP has no ePrivacy-style prior-consent rule and regulates on a
+ * transparency/opt-out basis — so the two sets genuinely disagree.
+ *
+ * That disagreement is resolved in the only direction that is safe to resolve
+ * unilaterally: Aglyn's OWN surfaces take the stricter reading, and the tenant
+ * set is left exactly as it is. Widening
+ * `PRIOR_CONSENT_COUNTRY_CODES` would flip Swiss visitors on every CUSTOMER
+ * site from tracked to banner-gated — a change to customers' compliance
+ * posture, made on their behalf, which is the specific thing this work is
+ * scoped out of.
+ */ export const PLATFORM_EXTRA_PRIOR_CONSENT_CODES = [
+    'CH'
+];
+/**
+ * The regions whose analytics default is DENIED on Aglyn's own surfaces.
+ *
+ * DERIVED from the tenant's canonical prior-consent set rather than retyped
+ * beside it. Two hand-maintained country lists is how one of them ends up a
+ * year behind the other, and the failure is silent in both directions: a
+ * missing code tracks a European visitor by default, a stale extra one just
+ * loses data. Deriving means an EU membership change is edited once.
+ *
+ * Sorted so the emitted snippet is byte-stable across builds — the docs
+ * site's copy of it is checked character-for-character.
+ */ export const PLATFORM_PRIOR_CONSENT_REGIONS = [
+    ...new Set([
+        ...PRIOR_CONSENT_COUNTRY_CODES,
+        ...PLATFORM_EXTRA_PRIOR_CONSENT_CODES
+    ])
+].sort();
+/**
+ * The declaration, in emission order.
+ *
+ * The global default comes first and grants analytics — the implied-consent
+ * posture, lawful in the US and most of the world. The region-scoped
+ * declaration follows and denies it for the prior-consent regions. Both are
+ * `default` (never `update`): a default is read before the tag's first hit,
+ * whereas an update arrives after `config` and would leave the session's
+ * first pageview — often the whole session — in the wrong state.
+ */ export const PLATFORM_CONSENT_DEFAULT_COMMANDS = [
+    {
+        analytics_storage: 'granted',
+        /*
+       * Advertising is granted here for the same reason analytics is: outside
+       * the prior-consent regions the posture is implied consent, and Aglyn
+       * advertises, remarkets and retargets across all of its own surfaces —
+       * the marketing site, this console and the docs. The Privacy Policy names
+       * the console among them.
+       *
+       * The region-scoped declaration below still denies all four for the
+       * UK/EU/EEA/CH set, and a visitor there gets nothing until they accept.
+       */ ad_storage: 'granted',
+        ad_user_data: 'granted',
+        ad_personalization: 'granted'
+    },
+    {
+        analytics_storage: 'denied',
+        ad_storage: 'denied',
+        ad_user_data: 'denied',
+        ad_personalization: 'denied',
+        region: PLATFORM_PRIOR_CONSENT_REGIONS
+    }
+];
+/**
+ * What the declaration above actually MEANS for a visitor in `country`.
+ *
+ * This exists so the defaults can be tested against the thing that ships
+ * rather than against a second copy of the same opinion. It reads
+ * {@link PLATFORM_CONSENT_DEFAULT_COMMANDS} and applies Google's documented
+ * resolution rule — the most specific matching `region` wins, and a
+ * declaration with no `region` is the fallback — so a test that asserts
+ * "DE is denied" fails the moment `DE` stops being in the emitted payload.
+ *
+ * `null`/unknown resolves to the GLOBAL default, which is `granted`. That is
+ * the declaration modelled honestly, not a wish: region matching is done by
+ * Google from the request IP, not by us, so "we do not know the country" is
+ * not a state this mechanism can act on. It is also the one place this module
+ * is weaker than the tenant gate, which resolves unknown-region to opt-in —
+ * another reason the tenant gate is the better mechanism where it can run.
+ */ export function resolvePlatformConsentDefault(country) {
+    const code = typeof country === 'string' ? country.trim().toUpperCase() : '';
+    let fallback = null;
+    let matched = null;
+    for (const command of PLATFORM_CONSENT_DEFAULT_COMMANDS){
+        if (command.region === undefined) {
+            fallback = command;
+            continue;
+        }
+        // `strictNullChecks` is off repo-wide, so `!code` would also swallow a
+        // genuine miss; compare explicitly.
+        if (code !== '' && command.region.indexOf(code) >= 0) matched = command;
+    }
+    const winner = matched === null ? fallback : matched;
+    /*
+   * Every signal is READ off the winning command. Restating the advertising
+   * three as literals here made this resolver a second declaration that could
+   * disagree with the one that ships — and it did: the emitted global default
+   * granted them while this said denied, so a test asserting the resolver
+   * proved nothing about the snippet in the page.
+   */ return {
+        analytics_storage: winner.analytics_storage,
+        ad_storage: winner.ad_storage,
+        ad_user_data: winner.ad_user_data,
+        ad_personalization: winner.ad_personalization
+    };
+}
+/**
+ * The declaration as an inline-script snippet.
+ *
+ * Built by serializing {@link PLATFORM_CONSENT_DEFAULT_COMMANDS} — no caller
+ * input reaches it and every value is a literal fixed at module load, which
+ * matters because it lands inside an inline `<script>` (the AGL-138 concern).
+ *
+ * Assumes the canonical `function gtag(){dataLayer.push(arguments);}` shim is
+ * already defined ABOVE it. gtag.js processes `arguments` objects, not plain
+ * arrays, so a `dataLayer.push([...])` here would be the classic silent
+ * no-op: no error, no consent declaration, and nothing in any GA report to
+ * show for it.
+ *
+ * `apps/docs` cannot import from `libs/` (AGL-1595), so the docs site carries
+ * a VERBATIM COPY of this string and
+ * `apps/console/specs/docs-platform-consent-snippet.spec.ts` fails if the two
+ * ever drift — the same treatment `INTERNAL_TRAFFIC_GTAG_SNIPPET` gets, and
+ * for the same reason: a stale copy still runs without error and still reads
+ * like a working declaration.
+ */ export const PLATFORM_CONSENT_DEFAULT_SNIPPET = PLATFORM_CONSENT_DEFAULT_COMMANDS.map((command)=>`gtag('consent','default',${JSON.stringify(command)});`).join('');
+/**
+ * Declare the defaults on a window, for surfaces that boot their tag from JS
+ * rather than from an inline script — i.e. the console, whose gtag is
+ * injected by the Firebase Analytics SDK.
+ *
+ * MUST be called before the SDK initializes, because a `default` read after
+ * the tag's `config` is not a default at all. The queue is what makes that
+ * orderable: pushing here lands the declaration in `dataLayer` ahead of
+ * everything gtag.js later processes, even though gtag.js is not loaded yet.
+ *
+ * Pushes a real `arguments` object, never an array literal — see the snippet
+ * note above for what the array form silently does.
+ *
+ * Idempotent per window: a second call is a no-op, so a remount or a
+ * re-entrant services boot cannot stack duplicate declarations.
+ */ export function pushPlatformConsentDefault(win) {
+    if (!win) return false;
+    const marked = win;
+    if (marked.__aglynConsentDefaultPushed === true) return false;
+    const layer = win.dataLayer === undefined ? [] : win.dataLayer;
+    win.dataLayer = layer;
+    // Declared without parameters ON PURPOSE: the body forwards the live
+    // `arguments` object, and a rest parameter would hand gtag.js a plain
+    // array instead.
+    function gtag() {
+        // eslint-disable-next-line prefer-rest-params
+        layer.push(arguments);
+    }
+    const queue = gtag;
+    for (const command of PLATFORM_CONSENT_DEFAULT_COMMANDS){
+        queue('consent', 'default', command);
+    }
+    marked.__aglynConsentDefaultPushed = true;
+    return true;
+}
+
+//# sourceMappingURL=platform-consent-default.js.map

package/src/lib/app-utils/platform-consent-default.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/platform-consent-default.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The Consent Mode v2 `default` declaration for AGLYN'S OWN surfaces — the\n * console (`app.aglyn.com`) and the docs site (`docs.aglyn.com`) (AGL-1597).\n *\n * the decision, 2026-08-20: analytics is ENABLED BY DEFAULT with implied\n * consent **where that is lawful**, and denied by default where prior consent\n * is required. This module is the \"where applicable\" half, expressed in the\n * one mechanism that can carry it on a surface with no consent gate: a\n * region-scoped `gtag('consent', 'default', …)`.\n *\n * ## Which surfaces this is for, and — load-bearing — which it is NOT\n *\n * Aglyn runs GA4 `G-YW5PG16YTM` on three of its own domains, and they did not\n * arrive at the same posture:\n *\n * - **`aglyn.com`** — served by the TENANT runtime, so it already runs the\n *   full AGL-1498 gate: a Firestore `consent.mode`, `/api/consent/region`, a\n *   per-visitor record in localStorage, and a tag that never LOADS for a\n *   visitor who has not granted. It is already default-on outside the\n *   prior-consent regions. **This module does not touch it and must not.**\n *\n *   ⚠️ Its AD signals DIVERGE from this module's, and that is expected rather\n *   than a defect — the two domains answer to different rules and always have.\n *   The history is worth carrying because the divergence has flipped twice:\n *   AGL-2402 (2026-08-21) let the implied default carry advertising, the\n *   marketing host had opted into asking, and a US visitor was measured on\n *   2026-08-23 with the record\n *   `{\"status\":\"implied\",\"analytics\":true,\"advertising\":true,\"country\":\"US\"}`\n *   and a collect hit carrying `gcs=G111` — ad storage GRANTED. That was\n *   narrowed back on 2026-08-24 and widened again on 2026-08-25 once the\n *   Cookie Policy master was rewritten to match the Privacy Policy's opt-out\n *   description, so the 2026-08-23 measurement is once more the shape the\n *   current rule produces.\n *\n *   This module now takes the SAME advertising posture for `app.aglyn.com`,\n *   which stopped being the asymmetry it once was once the console grew the\n *   surfaces an implied grant rests on: a per-visitor record, an account-menu\n *   control, and the CCPA §7015 pill on the unauthenticated pages. An implied\n *   grant needs a visitor who COULD have said no, and there they can.\n *\n *   `docs.aglyn.com` still cannot ask anybody anything, which is exactly why\n *   its non-Google advertising tags do not run on this declaration at all —\n *   they run on the console's record, mirrored across the registrable domain.\n *   This declaration reaches the tags that read Consent Mode, and nothing\n *   else does read it.\n *\n *   ⛔ Re-measure `aglyn.com` before relying on any comparison here; the\n *   numbers above are a record of what was seen, not a claim about today.\n * - **`app.aglyn.com` and `docs.aglyn.com`** — GA loads unconditionally on\n *   both (no gate can run here), and BEFORE this module they carried no\n *   consent declaration of any kind. That was not \"default on where lawful\";\n *   it was default on EVERYWHERE, prior-consent regions included, which is the\n *   gap AGL-1597 was filed for. These two are what this module is wired into.\n *\n *   On the docs side, being wired in was not enough on its own: the\n *   declaration was emitted but landed AFTER the gtag preset's `config`, which\n *   makes it a no-op. See the `ssrTemplate` note in\n *   `apps/docs/docusaurus.config.ts` — position matters as much as presence.\n * - **Customer/tenant sites** — NOT in scope by a wide margin. Aglyn ships\n *   the consent gate to customers as a product (AGL-1498) and the host\n *   chooses the posture. Changing their default would configure a customer's\n *   compliance posture for them, for visitors who may well be European. The\n *   separation here is structural rather than a matter of care: this module\n *   is imported only by the console's Firebase Analytics boot and copied into\n *   the docs site's `ssrTemplate` bootstrap. Nothing in the tenant runtime\n *   reads it, and\n *   `visitor-consent.ts` — the tenant's decision module — is unchanged.\n *\n * ## Why a region-scoped `default` here, and not the tenant's gate\n *\n * The tenant gate is strictly stronger: the tag never loads at all for a\n * gated visitor. It is also unavailable here. It needs a host document, a\n * per-host storage key and a region endpoint, none of which exist on a static\n * Docusaurus build or on the console's Firebase-owned tag — and porting it\n * would be a third implementation of consent, the outcome AGL-1579 explicitly\n * ruled out. So this is the weaker mechanism applied where the stronger one\n * cannot reach, and it is strictly better than what it replaces (nothing).\n *\n * It is NOT equivalent, and the difference should be stated rather than\n * glossed: under a denied `analytics_storage` the tag still LOADS and still\n * sends cookieless pings. That is a real residual question for the EEA/UK,\n * and it is flagged on AGL-1597 rather than papered over here.\n *\n * ## The ad signals\n *\n * `ad_storage`, `ad_user_data` and `ad_personalization` are GRANTED in the\n * global default and DENIED in the region-scoped one, which is the same split\n * `analytics_storage` takes and for the same reason: outside the prior-consent\n * regions the posture is implied consent, and Aglyn advertises, remarkets and\n * retargets across all of its own surfaces. A visitor in the EEA, the UK or\n * Switzerland gets all four denied until they accept.\n *\n * All three signals matter separately and Google treats them separately. A\n * declaration granting `ad_storage` alone leaves remarketing collecting\n * nothing while the tag looks perfectly healthy in GA4 — hits are sent, the\n * property fills up, and the audience stays empty. Read\n * {@link PLATFORM_CONSENT_DEFAULT_COMMANDS} rather than this paragraph if the\n * two ever disagree; the commands are what ships.\n *\n * The console does have a place to record an answer — a per-visitor record,\n * an account-menu control and the CCPA §7015 pill on its unauthenticated\n * pages — and {@link platformAsksAboutAdvertising} derives the question from\n * these very commands, so the control and the declaration cannot drift apart.\n * The docs site has neither, which is why the tags it mounts are gated on the\n * console's record rather than on this declaration; see\n * `apps/docs/src/advertising-tags.ts`.\n *\n * Before this module these surfaces declared nothing at all, which left a\n * freshly loaded tag with ad storage UNRESTRICTED in every region — so the\n * region-scoped denial below was a tightening, not a preference.\n */\n\nimport { PRIOR_CONSENT_COUNTRY_CODES } from './visitor-consent'\n\n/** A single consent-mode signal value. */\nexport type PlatformConsentSignal = 'granted' | 'denied'\n\n/**\n * Switzerland, and why it is here but NOT in the tenant's set.\n *\n * Aglyn's own consent brief treats the EEA, the UK **and Switzerland** as\n * prior opt-in, and none of those regions may be defaulted on. The tenant's\n * {@link PRIOR_CONSENT_COUNTRY_CODES} does not include `CH` — defensibly, the\n * revised FADP has no ePrivacy-style prior-consent rule and regulates on a\n * transparency/opt-out basis — so the two sets genuinely disagree.\n *\n * That disagreement is resolved in the only direction that is safe to resolve\n * unilaterally: Aglyn's OWN surfaces take the stricter reading, and the tenant\n * set is left exactly as it is. Widening\n * `PRIOR_CONSENT_COUNTRY_CODES` would flip Swiss visitors on every CUSTOMER\n * site from tracked to banner-gated — a change to customers' compliance\n * posture, made on their behalf, which is the specific thing this work is\n * scoped out of.\n */\nexport const PLATFORM_EXTRA_PRIOR_CONSENT_CODES: readonly string[] = ['CH']\n\n/**\n * The regions whose analytics default is DENIED on Aglyn's own surfaces.\n *\n * DERIVED from the tenant's canonical prior-consent set rather than retyped\n * beside it. Two hand-maintained country lists is how one of them ends up a\n * year behind the other, and the failure is silent in both directions: a\n * missing code tracks a European visitor by default, a stale extra one just\n * loses data. Deriving means an EU membership change is edited once.\n *\n * Sorted so the emitted snippet is byte-stable across builds — the docs\n * site's copy of it is checked character-for-character.\n */\nexport const PLATFORM_PRIOR_CONSENT_REGIONS: readonly string[] = [\n  ...new Set([\n    ...PRIOR_CONSENT_COUNTRY_CODES,\n    ...PLATFORM_EXTRA_PRIOR_CONSENT_CODES,\n  ]),\n].sort()\n\n/**\n * The four signals a consent-mode declaration carries.\n *\n * All four are the full signal type. Pinning the three advertising ones to the\n * literal `'denied'` made the type a second, silent policy — a declaration that\n * granted advertising anywhere would not compile, so the surface could never\n * take an ad tag without someone first noticing the type was the thing\n * refusing. The policy belongs in the values below, where it can be read.\n */\nexport interface PlatformConsentSignals {\n  analytics_storage: PlatformConsentSignal\n  ad_storage: PlatformConsentSignal\n  ad_user_data: PlatformConsentSignal\n  ad_personalization: PlatformConsentSignal\n}\n\n/**\n * One `gtag('consent', 'default', …)` payload. `region` absent means the\n * declaration applies wherever no region-scoped one matches.\n */\nexport interface PlatformConsentDefaultCommand extends PlatformConsentSignals {\n  region?: readonly string[]\n}\n\n/**\n * The declaration, in emission order.\n *\n * The global default comes first and grants analytics — the implied-consent\n * posture, lawful in the US and most of the world. The region-scoped\n * declaration follows and denies it for the prior-consent regions. Both are\n * `default` (never `update`): a default is read before the tag's first hit,\n * whereas an update arrives after `config` and would leave the session's\n * first pageview — often the whole session — in the wrong state.\n */\nexport const PLATFORM_CONSENT_DEFAULT_COMMANDS: readonly PlatformConsentDefaultCommand[] =\n  [\n    {\n      analytics_storage: 'granted',\n      /*\n       * Advertising is granted here for the same reason analytics is: outside\n       * the prior-consent regions the posture is implied consent, and Aglyn\n       * advertises, remarkets and retargets across all of its own surfaces —\n       * the marketing site, this console and the docs. The Privacy Policy names\n       * the console among them.\n       *\n       * The region-scoped declaration below still denies all four for the\n       * UK/EU/EEA/CH set, and a visitor there gets nothing until they accept.\n       */\n      ad_storage: 'granted',\n      ad_user_data: 'granted',\n      ad_personalization: 'granted',\n    },\n    {\n      analytics_storage: 'denied',\n      ad_storage: 'denied',\n      ad_user_data: 'denied',\n      ad_personalization: 'denied',\n      region: PLATFORM_PRIOR_CONSENT_REGIONS,\n    },\n  ]\n\n/**\n * What the declaration above actually MEANS for a visitor in `country`.\n *\n * This exists so the defaults can be tested against the thing that ships\n * rather than against a second copy of the same opinion. It reads\n * {@link PLATFORM_CONSENT_DEFAULT_COMMANDS} and applies Google's documented\n * resolution rule — the most specific matching `region` wins, and a\n * declaration with no `region` is the fallback — so a test that asserts\n * \"DE is denied\" fails the moment `DE` stops being in the emitted payload.\n *\n * `null`/unknown resolves to the GLOBAL default, which is `granted`. That is\n * the declaration modelled honestly, not a wish: region matching is done by\n * Google from the request IP, not by us, so \"we do not know the country\" is\n * not a state this mechanism can act on. It is also the one place this module\n * is weaker than the tenant gate, which resolves unknown-region to opt-in —\n * another reason the tenant gate is the better mechanism where it can run.\n */\nexport function resolvePlatformConsentDefault(\n  country: string | null | undefined,\n): PlatformConsentSignals {\n  const code = typeof country === 'string' ? country.trim().toUpperCase() : ''\n  let fallback: PlatformConsentDefaultCommand | null = null\n  let matched: PlatformConsentDefaultCommand | null = null\n  for (const command of PLATFORM_CONSENT_DEFAULT_COMMANDS) {\n    if (command.region === undefined) {\n      fallback = command\n      continue\n    }\n    // `strictNullChecks` is off repo-wide, so `!code` would also swallow a\n    // genuine miss; compare explicitly.\n    if (code !== '' && command.region.indexOf(code) >= 0) matched = command\n  }\n  const winner = matched === null ? fallback : matched\n  /*\n   * Every signal is READ off the winning command. Restating the advertising\n   * three as literals here made this resolver a second declaration that could\n   * disagree with the one that ships — and it did: the emitted global default\n   * granted them while this said denied, so a test asserting the resolver\n   * proved nothing about the snippet in the page.\n   */\n  return {\n    analytics_storage: winner.analytics_storage,\n    ad_storage: winner.ad_storage,\n    ad_user_data: winner.ad_user_data,\n    ad_personalization: winner.ad_personalization,\n  }\n}\n\n/**\n * The declaration as an inline-script snippet.\n *\n * Built by serializing {@link PLATFORM_CONSENT_DEFAULT_COMMANDS} — no caller\n * input reaches it and every value is a literal fixed at module load, which\n * matters because it lands inside an inline `<script>` (the AGL-138 concern).\n *\n * Assumes the canonical `function gtag(){dataLayer.push(arguments);}` shim is\n * already defined ABOVE it. gtag.js processes `arguments` objects, not plain\n * arrays, so a `dataLayer.push([...])` here would be the classic silent\n * no-op: no error, no consent declaration, and nothing in any GA report to\n * show for it.\n *\n * `apps/docs` cannot import from `libs/` (AGL-1595), so the docs site carries\n * a VERBATIM COPY of this string and\n * `apps/console/specs/docs-platform-consent-snippet.spec.ts` fails if the two\n * ever drift — the same treatment `INTERNAL_TRAFFIC_GTAG_SNIPPET` gets, and\n * for the same reason: a stale copy still runs without error and still reads\n * like a working declaration.\n */\nexport const PLATFORM_CONSENT_DEFAULT_SNIPPET =\n  PLATFORM_CONSENT_DEFAULT_COMMANDS.map(\n    (command) => `gtag('consent','default',${JSON.stringify(command)});`,\n  ).join('')\n\n/** The `dataLayer`-bearing window this module writes to. */\nexport interface ConsentDataLayerWindow {\n  dataLayer?: unknown[]\n}\n\n/**\n * Declare the defaults on a window, for surfaces that boot their tag from JS\n * rather than from an inline script — i.e. the console, whose gtag is\n * injected by the Firebase Analytics SDK.\n *\n * MUST be called before the SDK initializes, because a `default` read after\n * the tag's `config` is not a default at all. The queue is what makes that\n * orderable: pushing here lands the declaration in `dataLayer` ahead of\n * everything gtag.js later processes, even though gtag.js is not loaded yet.\n *\n * Pushes a real `arguments` object, never an array literal — see the snippet\n * note above for what the array form silently does.\n *\n * Idempotent per window: a second call is a no-op, so a remount or a\n * re-entrant services boot cannot stack duplicate declarations.\n */\nexport function pushPlatformConsentDefault(\n  win: ConsentDataLayerWindow | null | undefined,\n): boolean {\n  if (!win) return false\n  const marked = win as { __aglynConsentDefaultPushed?: boolean }\n  if (marked.__aglynConsentDefaultPushed === true) return false\n  const layer = win.dataLayer === undefined ? [] : win.dataLayer\n  win.dataLayer = layer\n  // Declared without parameters ON PURPOSE: the body forwards the live\n  // `arguments` object, and a rest parameter would hand gtag.js a plain\n  // array instead.\n  function gtag(): void {\n    // eslint-disable-next-line prefer-rest-params\n    layer.push(arguments)\n  }\n  const queue = gtag as (...args: unknown[]) => void\n  for (const command of PLATFORM_CONSENT_DEFAULT_COMMANDS) {\n    queue('consent', 'default', command)\n  }\n  marked.__aglynConsentDefaultPushed = true\n  return true\n}\n"],"names":["PRIOR_CONSENT_COUNTRY_CODES","PLATFORM_EXTRA_PRIOR_CONSENT_CODES","PLATFORM_PRIOR_CONSENT_REGIONS","Set","sort","PLATFORM_CONSENT_DEFAULT_COMMANDS","analytics_storage","ad_storage","ad_user_data","ad_personalization","region","resolvePlatformConsentDefault","country","code","trim","toUpperCase","fallback","matched","command","undefined","indexOf","winner","PLATFORM_CONSENT_DEFAULT_SNIPPET","map","JSON","stringify","join","pushPlatformConsentDefault","win","marked","__aglynConsentDefaultPushed","layer","dataLayer","gtag","push","arguments","queue"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8GC,GAED,SAASA,2BAA2B,QAAQ,uBAAmB;AAK/D;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,MAAMC,qCAAwD;IAAC;CAAK,CAAA;AAE3E;;;;;;;;;;;CAWC,GACD,OAAO,MAAMC,iCAAoD;OAC5D,IAAIC,IAAI;WACNH;WACAC;KACJ;CACF,CAACG,IAAI,GAAE;AA0BR;;;;;;;;;CASC,GACD,OAAO,MAAMC,oCACX;IACE;QACEC,mBAAmB;QACnB;;;;;;;;;OASC,GACDC,YAAY;QACZC,cAAc;QACdC,oBAAoB;IACtB;IACA;QACEH,mBAAmB;QACnBC,YAAY;QACZC,cAAc;QACdC,oBAAoB;QACpBC,QAAQR;IACV;CACD,CAAA;AAEH;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,SAASS,8BACdC,OAAkC;IAElC,MAAMC,OAAO,OAAOD,YAAY,WAAWA,QAAQE,IAAI,GAAGC,WAAW,KAAK;IAC1E,IAAIC,WAAiD;IACrD,IAAIC,UAAgD;IACpD,KAAK,MAAMC,WAAWb,kCAAmC;QACvD,IAAIa,QAAQR,MAAM,KAAKS,WAAW;YAChCH,WAAWE;YACX;QACF;QACA,uEAAuE;QACvE,oCAAoC;QACpC,IAAIL,SAAS,MAAMK,QAAQR,MAAM,CAACU,OAAO,CAACP,SAAS,GAAGI,UAAUC;IAClE;IACA,MAAMG,SAASJ,YAAY,OAAOD,WAAWC;IAC7C;;;;;;GAMC,GACD,OAAO;QACLX,mBAAmBe,OAAOf,iBAAiB;QAC3CC,YAAYc,OAAOd,UAAU;QAC7BC,cAAca,OAAOb,YAAY;QACjCC,oBAAoBY,OAAOZ,kBAAkB;IAC/C;AACF;AAEA;;;;;;;;;;;;;;;;;;;CAmBC,GACD,OAAO,MAAMa,mCACXjB,kCAAkCkB,GAAG,CACnC,CAACL,UAAY,CAAC,yBAAyB,EAAEM,KAAKC,SAAS,CAACP,SAAS,EAAE,CAAC,EACpEQ,IAAI,CAAC,IAAG;AAOZ;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASC,2BACdC,GAA8C;IAE9C,IAAI,CAACA,KAAK,OAAO;IACjB,MAAMC,SAASD;IACf,IAAIC,OAAOC,2BAA2B,KAAK,MAAM,OAAO;IACxD,MAAMC,QAAQH,IAAII,SAAS,KAAKb,YAAY,EAAE,GAAGS,IAAII,SAAS;IAC9DJ,IAAII,SAAS,GAAGD;IAChB,qEAAqE;IACrE,sEAAsE;IACtE,iBAAiB;IACjB,SAASE;QACP,8CAA8C;QAC9CF,MAAMG,IAAI,CAACC;IACb;IACA,MAAMC,QAAQH;IACd,KAAK,MAAMf,WAAWb,kCAAmC;QACvD+B,MAAM,WAAW,WAAWlB;IAC9B;IACAW,OAAOC,2BAA2B,GAAG;IACrC,OAAO;AACT"}

package/src/lib/app-utils/platform-marketing-consent.d.ts

@@ -0,0 +1,151 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Marketing consent for the PLATFORM's own product email (AGL-3185).
+ *
+ * The strict policy (`marketing-consent.ts`) means a person with no declared
+ * basis is unsendable, and until this module the only doors that declared
+ * one were the marketing site's forms. Somebody who created a console account
+ * — the warmest audience the platform has — was never asked. Three console
+ * doors ask now: a checkbox on the sign-up form, a switch in the account
+ * preferences, and a one-time prompt for accounts that predate the checkbox.
+ *
+ * ## One wording, versioned
+ *
+ * Every door shows {@link PLATFORM_MARKETING_CONSENT_TEXT} and every record
+ * stores {@link PLATFORM_MARKETING_CONSENT_TEXT_VERSION} beside the exact
+ * timestamp, so "what did this person agree to" is answered by a version and
+ * not by whatever the checkbox says today. Changing the sentence is a bump of
+ * the version in the same edit.
+ *
+ * ## The record lives in two places, and the two do not disagree
+ *
+ * The decision is written by the server onto the person's own `users/{uid}`
+ * document, so the console can show a preference without reading the
+ * operator's CRM, and onto the operator's marketing contact for the same
+ * person, so the send path sees a declared basis with provenance. The
+ * contact half is written only when the deployment names a marketing host
+ * (`PLATFORM_MARKETING_HOST_ID`, read in `@aglyn/tenant-data-admin`); a
+ * self-hosted install with no audience of its own records the preference
+ * and skips the contact.
+ *
+ * ## Absence is not refusal
+ *
+ * An unticked sign-up checkbox records nothing. A switch turned off and a
+ * prompt answered "no" record a refusal, which the strict policy already
+ * honors. A prompt dismissed without an answer records only the dismissal,
+ * and the prompt stays away for {@link PLATFORM_MARKETING_PROMPT_SNOOZE_MS}.
+ *
+ * Pure and dependency-light on purpose: the sign-up page renders the text,
+ * the console route validates the body, and the server library writes the
+ * record, all from this one module.
+ */
+import { type MarketingConsentSource } from './marketing-consent';
+/** The console doors a decision can come through, as the record names them. */
+export declare const PLATFORM_MARKETING_CONSENT_SOURCE_KINDS: readonly ["console-signup", "console-preferences", "console-prompt"];
+export type PlatformMarketingConsentSourceKind = (typeof PLATFORM_MARKETING_CONSENT_SOURCE_KINDS)[number];
+export declare function isPlatformMarketingConsentSourceKind(value: unknown): value is PlatformMarketingConsentSourceKind;
+/** What a door records: a grant or a refusal. Absence is never recorded. */
+export declare const PLATFORM_MARKETING_CONSENT_DECISIONS: readonly ["granted", "declined"];
+export type PlatformMarketingConsentDecision = (typeof PLATFORM_MARKETING_CONSENT_DECISIONS)[number];
+export declare function isPlatformMarketingConsentDecision(value: unknown): value is PlatformMarketingConsentDecision;
+/**
+ * The version of the consent wording every door shows. Bumped in the same
+ * edit as {@link platformMarketingConsentText}; a record stores the version
+ * it was shown under, so the two must move together.
+ */
+export declare const PLATFORM_MARKETING_CONSENT_TEXT_VERSION = "2026-09-20";
+/**
+ * The sentence the person agrees to, with the deployment's brand in it.
+ *
+ * Affirmative and standalone: it names what is sent, who sends it, and that
+ * it can be stopped — never bundled with the terms acceptance, and never
+ * pre-ticked anywhere it is rendered.
+ */
+export declare function platformMarketingConsentText(brandName: string): string;
+/** {@link platformMarketingConsentText} for the brand this deployment wears. */
+export declare const PLATFORM_MARKETING_CONSENT_TEXT: string;
+/**
+ * The `users/{uid}` fields the decision is mirrored onto.
+ *
+ * The same names the contact record uses for the same facts, so one reader
+ * can parse either document. The prompt-dismissal stamp has no contact
+ * counterpart: it is about what the console asked, not what the person
+ * agreed to.
+ */
+export declare const USER_MARKETING_CONSENT_FIELD = "marketingConsent";
+export declare const USER_MARKETING_CONSENT_AT_FIELD = "marketingConsentAtMs";
+export declare const USER_MARKETING_CONSENT_SOURCE_FIELD = "marketingConsentSource";
+export declare const USER_MARKETING_PROMPT_DISMISSED_AT_FIELD = "marketingConsentPromptDismissedAtMs";
+/** How long a dismissed prompt stays away: ninety days. */
+export declare const PLATFORM_MARKETING_PROMPT_SNOOZE_MS: number;
+/** What the person's own document says about product email. */
+export interface PlatformMarketingConsentState {
+    /** `null` when nothing has been recorded — asked, but not answered. */
+    decision: PlatformMarketingConsentDecision | null;
+    /** When the decision was recorded. */
+    atMs: number | null;
+    /** The wording version the decision was made under. */
+    textVersion: string | null;
+    /** Which console door recorded it; `null` for a record another writer left. */
+    sourceKind: PlatformMarketingConsentSourceKind | null;
+    /** When the prompt was last dismissed without an answer. */
+    promptDismissedAtMs: number | null;
+}
+/**
+ * Reads the decision off a `users/{uid}` document, or off no document.
+ *
+ * Every unusable value reads as its absent case rather than throwing: a
+ * malformed field must degrade to "nothing recorded", which asks again,
+ * never to a grant.
+ */
+export declare function readPlatformMarketingConsent(document: Record<string, unknown> | null | undefined): PlatformMarketingConsentState;
+/**
+ * Whether the console should ask this person now.
+ *
+ * Never after a decision, in either direction: a "no" is an answer and a
+ * "yes" needs no repeating. A dismissal is not an answer, so the prompt
+ * returns once the snooze has run out.
+ */
+export declare function platformMarketingPromptDue(state: Pick<PlatformMarketingConsentState, 'decision' | 'promptDismissedAtMs'>, nowMs: number): boolean;
+/**
+ * The provenance stored with a console decision, on both documents.
+ *
+ * `actor: 'person'` is what keeps {@link MarketingConsentSource} honest here:
+ * the reader treats provenance as an operator's assertion unless it says
+ * otherwise, and this is the person's own click, carrying which door and
+ * which wording. `by` is the account that clicked — the subject and the
+ * actor are the same human, which is the fact the field records.
+ */
+export declare function platformMarketingConsentSource(input: {
+    kind: PlatformMarketingConsentSourceKind;
+    decision: PlatformMarketingConsentDecision;
+    uid: string;
+    atMs: number;
+    textVersion: string;
+}): MarketingConsentSource;
+/**
+ * The `users/{uid}` fields a decision writes, as one merge-able object.
+ *
+ * `false` for a refusal, not a deleted field: absence is the third state and
+ * means "never asked", which a person who said no must never read as again.
+ */
+export declare function platformMarketingUserFields(input: {
+    decision: PlatformMarketingConsentDecision;
+    atMs: number;
+    source: MarketingConsentSource;
+}): Record<string, unknown>;