@aglyn/aglyn 1.0.0-beta.143

package/src/lib/app-utils/platform-visitor-consent.js

@@ -0,0 +1,533 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Visitor consent for AGLYN'S OWN console (`app.aglyn.com`) — the same
+ * decision the tenant runtime makes for a customer site, resolved against a
+ * surface that has no host document.
+ *
+ * ## What this module is, and what it deliberately is not
+ *
+ * It is a COMPOSITION of `visitor-consent.ts`, not a second consent engine.
+ * Every question a decision actually turns on is answered there: which
+ * statuses grant which category ({@link analyticsGrantedByStatus},
+ * {@link advertisingGrantedByStatus}), how a record is read and written
+ * ({@link readStoredVisitorConsent}, {@link storeVisitorConsent}), what a
+ * withdrawal sweeps, and what consent-mode signals a pair of grants becomes
+ * ({@link consentModeSignals}). A second implementation of any of those is how
+ * two surfaces come to disagree about whether a visitor said yes, and the
+ * disagreement is invisible from either side.
+ *
+ * What lives here is only what the console answers DIFFERENTLY, and there are
+ * exactly three such things:
+ *
+ * 1. **There is no host document.** A customer site's posture, its gated
+ *    categories and its advertising question all come off `hosts/{id}`. The
+ *    console has none, so the equivalents are constants derived below from
+ *    what this surface actually runs.
+ * 2. **The prior-consent region set is the platform's, not the tenant's.**
+ *    `PLATFORM_PRIOR_CONSENT_REGIONS` adds Switzerland to the tenant's
+ *    ePrivacy set, because Aglyn's own brief treats CH as prior opt-in while
+ *    the tenant set stays exactly as customers' sites have it. Reusing that
+ *    constant rather than restating a country list is the point — two
+ *    hand-kept lists is how one of them ends up a year behind the other.
+ * 3. **The storage subject is fixed.** Records are keyed by host id so one
+ *    site's yes cannot leak to another's; the console is one surface, so it
+ *    takes one constant subject and shares the same `aglyn:consent:` prefix,
+ *    the same versioned record shape, and the same reader/writer.
+ *
+ * ## The posture, which is the tenant's posture
+ *
+ * - **UK / EU / EEA — and any visitor whose region cannot be determined** —
+ *   `opt-in`: nothing non-essential runs until an explicit accept. Undecided
+ *   is not a maybe.
+ * - **Everywhere else** — `opt-out`: implied consent is recorded on the first
+ *   visit, analytics runs from that first paint, and the visitor can withdraw
+ *   at any time from the account menu.
+ * - **GPC** is honored as an automatic opt-out in both postures, and is
+ *   overridden only by a later explicit accept.
+ *
+ * ## Advertising on this surface
+ *
+ * Asked about only where something would read the answer — see
+ * {@link platformAsksAboutAdvertising}, which derives it from the consent
+ * defaults this surface actually declares rather than from a flag someone has
+ * to remember to keep in step.
+ */ import { PLATFORM_CONSENT_DEFAULT_COMMANDS, PLATFORM_PRIOR_CONSENT_REGIONS } from "./platform-consent-default.js";
+import { geoHintFromTimeZone, readBrowserTimeZone } from "./timezone-geo-hint.js";
+import { analyticsGrantedByStatus, hasGlobalPrivacyControl, isExplicitConsentStatus, readStoredVisitorConsent, refusalStatusFor, registrableCookieDomain, storeVisitorConsent, visitorConsentStorageKey } from "./visitor-consent.js";
+/**
+ * The storage subject for the console's own consent record.
+ *
+ * `visitorConsentStorageKey` keys records by host id because preview
+ * deployments and localhost serve many customer sites from one origin. The
+ * console is a single surface, so it takes a constant — but it takes it
+ * through the same key builder, so a console record and a customer-site record
+ * can never collide, and a self-hosted console on the same origin as a site
+ * keeps its own.
+ *
+ * A name, not a hostname: the console is served from `app.aglyn.com`, from a
+ * custom console domain (AGL-1099c), and from localhost, and a visitor's
+ * choice is about the surface rather than about which of its origins they
+ * reached it through.
+ */ export const PLATFORM_CONSENT_SUBJECT = 'aglyn-console';
+/**
+ * Where the client asks which country it is visiting from.
+ *
+ * The same path the tenant runtime uses, and for the same reason: the answer
+ * is a per-visitor request header, so it cannot be baked into a render. Each
+ * app serves its own route handler at this path.
+ */ export const PLATFORM_CONSENT_REGION_ENDPOINT = '/api/consent/region';
+/** Session-scoped region cache — one lookup per visit, not per pageview. */ export const PLATFORM_CONSENT_REGION_CACHE_KEY = 'aglyn:consent:region';
+/**
+ * Whether this surface asks its visitors about advertising storage.
+ *
+ * DERIVED from {@link PLATFORM_CONSENT_DEFAULT_COMMANDS} rather than declared
+ * as its own flag. Those commands are what the console tells gtag about ad
+ * storage, so the question and the declaration cannot drift: a surface that
+ * denies advertising in every region asks nothing, and one that grants it
+ * anywhere asks.
+ *
+ * A control whose answer changes nothing is decoration, and decoration is what
+ * teaches people to click past the controls that do matter — which is the
+ * whole reason this is derived rather than hardcoded either way.
+ *
+ * The console currently grants advertising outside the prior-consent regions,
+ * because Aglyn advertises, remarkets and retargets on its own surfaces and
+ * the Privacy Policy names this one among them. So the question IS asked, and
+ * a visitor who declines gets the signals denied and the tags torn down.
+ *
+ * `every`, so a single region-scoped grant is enough to make the question
+ * real. The console's whole visitor population is not asked about a category
+ * because one region's declaration happens to deny it.
+ */ export function platformAsksAboutAdvertising() {
+    return !PLATFORM_CONSENT_DEFAULT_COMMANDS.every((command)=>command.ad_storage === 'denied');
+}
+/**
+ * The per-visitor posture for the console, from the country the region
+ * endpoint reports.
+ *
+ * Unknown region falls to `opt-in`, exactly as it does for a customer site:
+ * the asymmetry is a few lost analytics events on a rare headerless visit,
+ * against pre-consent tracking of a European visitor.
+ *
+ * A separate function from the tenant's `resolveConsentPosture` because it
+ * answers over a different country set (see the module comment) — and it reads
+ * that set from `platform-consent-default.ts` rather than restating it, so the
+ * console's gate and the console's consent-mode declaration can never disagree
+ * about which regions require asking first.
+ */ export function platformConsentPosture(country) {
+    if (!country) return 'opt-in';
+    return PLATFORM_PRIOR_CONSENT_REGIONS.indexOf(country.toUpperCase()) >= 0 ? 'opt-in' : 'opt-out';
+}
+/**
+ * The cookie that carries a console visitor's answer between the sibling
+ * subdomains the console is served on.
+ *
+ * ## The defect this closes
+ *
+ * `localStorage` is per ORIGIN, and the console is one application served on
+ * several hostnames of one registrable domain: `app.<domain>` and
+ * `auth.<domain>`, which is where interactive sign-in is delegated to. So a
+ * record written on one is invisible to the other.
+ *
+ * For an accept that is only a second ask — annoying, and fail-safe, since an
+ * unread record means untracked. For a REFUSAL it is worse than annoying and
+ * not fail-safe at all: outside the prior-consent regions the sibling host
+ * finds no record, resolves the posture afresh and writes `implied`, so an
+ * explicit opt-out reverts to implied consent on the next hop. A visitor
+ * cannot be expected to say no once per hostname of an application they
+ * experience as one.
+ *
+ * ## Why a cookie, and why it carries the whole record
+ *
+ * A cookie is the only client-side store that spans subdomains, and the
+ * consent record is itself strictly necessary storage — it is how a "no" is
+ * remembered — so it needs no consent of its own. It carries the whole record
+ * rather than a flag because the record is what the shared reader validates:
+ * the mirror is re-read through `readStoredVisitorConsent`, never trusted, so
+ * a hand-edited cookie cannot grant what its status does not.
+ */ export const PLATFORM_CONSENT_COOKIE = 'aglyn_consent';
+/**
+ * How long the mirror lives. Thirteen months is the field convention for a
+ * consent record and the ceiling several supervisory authorities name; the
+ * record's own `at` stamp is what any future re-ask would be judged against.
+ */ const PLATFORM_CONSENT_COOKIE_MAX_AGE_SECONDS = 13 * 30 * 24 * 60 * 60;
+/**
+ * Whether this origin may share a visitor's answer with its sibling
+ * subdomains.
+ *
+ * OFF by default and switched on by the surface, which is the same polarity
+ * `originPersistenceClass` uses and for the same asymmetry. Writing at the
+ * registrable domain is only correct where the whole registrable domain is
+ * ours: on a CUSTOM console domain it would put our cookie on the customer's
+ * apex, beside their own site, on an origin the console is deliberately not
+ * allowed to keep durable state on. A surface that says nothing gets a
+ * host-only record, which is complete on its own because there are no
+ * siblings to disagree with.
+ */ let sharesAcrossSubdomains = false;
+export function setPlatformConsentSharesAcrossSubdomains(shares) {
+    sharesAcrossSubdomains = shares;
+}
+/** The raw mirror value for this browser, or null when there is none. */ function readPlatformConsentMirror() {
+    if (typeof document === 'undefined') return null;
+    try {
+        var _document_cookie;
+        for (const pair of String((_document_cookie = document.cookie) != null ? _document_cookie : '').split(';')){
+            const cut = pair.indexOf('=');
+            if (cut < 0) continue;
+            if (pair.slice(0, cut).trim() !== PLATFORM_CONSENT_COOKIE) continue;
+            return decodeURIComponent(pair.slice(cut + 1).trim());
+        }
+    } catch (unused) {
+    // Cookies disabled or a hostile `document.cookie`: no mirror, and the
+    // per-origin record still stands.
+    }
+    return null;
+}
+/**
+ * Write the mirror at the registrable domain, so the sibling host can read it.
+ *
+ * A no-op while sharing is off, and a no-op when the hostname has no
+ * registrable domain (`localhost`, an IP literal) — a host-only cookie there
+ * would duplicate the localStorage record and carry to nothing.
+ */ function writePlatformConsentMirror(stored) {
+    if (!sharesAcrossSubdomains || typeof document === 'undefined') return;
+    try {
+        var _window_location, _window_location1;
+        const hostname = typeof window === 'undefined' ? '' : (_window_location = window.location) == null ? void 0 : _window_location.hostname;
+        const domain = registrableCookieDomain(hostname);
+        if (!domain) return;
+        const secure = ((_window_location1 = window.location) == null ? void 0 : _window_location1.protocol) === 'https:' ? '; Secure' : '';
+        document.cookie = `${PLATFORM_CONSENT_COOKIE}=${encodeURIComponent(JSON.stringify(stored))}` + `; Max-Age=${PLATFORM_CONSENT_COOKIE_MAX_AGE_SECONDS}` + `; Path=/; Domain=.${domain}; SameSite=Lax${secure}`;
+    } catch (unused) {
+    // A refusal to write the mirror costs the carry-over, never the decision:
+    // the per-origin record is already stored by the caller.
+    }
+}
+/**
+ * Adopt a sibling host's answer into this origin, if this origin has none.
+ *
+ * Called ONCE at boot rather than from {@link readPlatformConsent}, because
+ * that reader is consulted synchronously from the analytics gate — during the
+ * services provider's first render, and again on every consent change — and a
+ * reader with a write in it would put a storage write in a render path and
+ * repeat it forever. Boot is also early enough by construction: module scope
+ * runs before the first render, so the gate's first read already sees it.
+ *
+ * The value is written into localStorage and then read back through
+ * {@link readPlatformConsent}, which is the whole reason this is safe. The
+ * shared reader re-derives both grants from the status and rejects an
+ * unrecognized shape, so a hand-edited cookie can only ever produce a record
+ * the status supports — the same guarantee the per-origin path has.
+ *
+ * Returns whether a record was adopted, which is what makes it assertable.
+ */ export function hydratePlatformConsentFromMirror() {
+    if (!sharesAcrossSubdomains || typeof window === 'undefined') return false;
+    // This origin's own answer always wins. It is the more recent statement by
+    // definition — a decision made here is mirrored outward on the way in.
+    if (readStoredVisitorConsent(PLATFORM_CONSENT_SUBJECT)) return false;
+    const raw = readPlatformConsentMirror();
+    if (!raw) return false;
+    try {
+        window.localStorage.setItem(visitorConsentStorageKey(PLATFORM_CONSENT_SUBJECT), raw);
+    } catch (unused) {
+        // Private mode: no adoption, and the visitor is asked again on this host.
+        return false;
+    }
+    // Validated, not assumed: a cookie whose shape or status the shared reader
+    // refuses leaves this origin with nothing, which is the undecided state.
+    if (readStoredVisitorConsent(PLATFORM_CONSENT_SUBJECT)) return true;
+    try {
+        // …and the refused value does not stay behind. The reader already answers
+        // null for it, but a key holding something unreadable is what the next
+        // person debugging this will find and believe.
+        window.localStorage.removeItem(visitorConsentStorageKey(PLATFORM_CONSENT_SUBJECT));
+    } catch (unused) {
+    // Nothing to clean up if storage is refusing us.
+    }
+    return false;
+}
+/** The console visitor's stored record, or null when there is none. */ export function readPlatformConsent() {
+    return readStoredVisitorConsent(PLATFORM_CONSENT_SUBJECT);
+}
+/**
+ * Record a console consent state.
+ *
+ * Delegates wholesale, which is what carries the withdrawal behaviour: the
+ * shared writer re-derives both grants from the status, silences any resident
+ * GA tag, sweeps the analytics and advertising cookies, drops the persistent
+ * visitor id, and dispatches `VISITOR_CONSENT_CHANGED_EVENT`. The console's
+ * analytics gate listens for that event, which is what makes a refusal act on
+ * this pageview instead of the next one.
+ */ export function storePlatformConsent(state) {
+    const stored = storeVisitorConsent(PLATFORM_CONSENT_SUBJECT, state);
+    // Mirrored on EVERY decision, including the refusals. A mirror that only
+    // carried grants would leave the worst case uncovered: an explicit opt-out
+    // on one host, then the sibling host finding nothing and writing `implied`
+    // from the posture — which is the visitor's refusal being overturned by a
+    // hop they did not make.
+    writePlatformConsentMirror(stored);
+    return stored;
+}
+/**
+ * The gate's whole verdict: may analytics run for this console visitor right
+ * now?
+ *
+ * Reads storage on every call rather than caching, because it is consulted
+ * synchronously from the Firebase services boot — before any effect has run,
+ * and again after a consent change — and a cached answer is exactly how a
+ * withdrawal fails to take effect until a reload.
+ *
+ * Absent record answers NO. That is the load-bearing half: an undecided
+ * visitor is a visitor the tag stays out of, whatever the reason for their
+ * being undecided, so the gate never has to ask WHY.
+ */ export function platformAnalyticsAllowed() {
+    var _readPlatformConsent;
+    return ((_readPlatformConsent = readPlatformConsent()) == null ? void 0 : _readPlatformConsent.analytics) === true;
+}
+/** Whether advertising storage may run for this console visitor. */ export function platformAdvertisingAllowed() {
+    var _readPlatformConsent;
+    if (!platformAsksAboutAdvertising()) return false;
+    return ((_readPlatformConsent = readPlatformConsent()) == null ? void 0 : _readPlatformConsent.advertising) === true;
+}
+/**
+ * The country this visitor is in, or null when nothing can name one.
+ *
+ * The country half of {@link resolvePlatformConsentRegion}, kept because a
+ * caller that only wants a country should not have to know that a posture can
+ * arrive without one.
+ */ export async function resolvePlatformConsentCountry() {
+    return (await resolvePlatformConsentRegion()).country;
+}
+/**
+ * The lookup that is CURRENTLY IN FLIGHT, shared by every caller that arrives
+ * while it is (AGL-2710).
+ *
+ * The session cache is written when the response lands, so on its own it
+ * dedupes a later pageview and nothing sooner: two components that both want
+ * the region during the same hydration both miss it and both ask. Released
+ * once the promise settles, so the "only a resolved country is cached, a
+ * failure is re-asked" rule below is untouched — this shares one request, it
+ * does not remember an answer.
+ */ let platformRegionInFlight = null;
+export async function resolvePlatformConsentRegion() {
+    if (typeof window === 'undefined') return {
+        country: null,
+        posture: null
+    };
+    try {
+        const cached = window.sessionStorage.getItem(PLATFORM_CONSENT_REGION_CACHE_KEY);
+        if (cached) {
+            const parsed = JSON.parse(cached);
+            // A cached entry counts only when it NAMES a country. Anything else —
+            // including `{"country":null}` written by a build from before this rule
+            // — is treated as a miss, which is what lets a tab that cached a failure
+            // heal itself on the next pageview instead of carrying it to the end of
+            // the session.
+            if (typeof (parsed == null ? void 0 : parsed.country) === 'string' && parsed.country) {
+                return {
+                    country: parsed.country,
+                    posture: null
+                };
+            }
+        }
+    } catch (unused) {
+    // No storage — ask every pageview; correct, just less frugal.
+    }
+    if (platformRegionInFlight) return platformRegionInFlight;
+    const pending = askPlatformConsentRegion().finally(()=>{
+        if (platformRegionInFlight === pending) platformRegionInFlight = null;
+    });
+    platformRegionInFlight = pending;
+    return pending;
+}
+async function askPlatformConsentRegion() {
+    let country = null;
+    try {
+        const response = await fetch(PLATFORM_CONSENT_REGION_ENDPOINT);
+        if (response.ok) {
+            const payload = await response.json().catch(()=>null);
+            country = typeof (payload == null ? void 0 : payload.country) === 'string' ? payload.country : null;
+        }
+    } catch (unused) {
+    // Network failure reads as no signal, which falls through exactly as an
+    // absent header does.
+    }
+    if (country) {
+        try {
+            // ONLY a resolved country is cached, and the asymmetry is the point. A
+            // cached country is a fact; a cached absence is a FAILURE, and caching a
+            // failure pins the outcome that failure produces. One cold edge, one
+            // request that skipped the proxy, and the visitor would spend the rest
+            // of the session on the strictest posture with nothing re-asking — a
+            // banner they cannot get rid of, and analytics that never resume.
+            window.sessionStorage.setItem(PLATFORM_CONSENT_REGION_CACHE_KEY, JSON.stringify({
+                country
+            }));
+        } catch (unused) {
+        // Best-effort cache only.
+        }
+        return {
+            country,
+            posture: null
+        };
+    }
+    // No header anywhere. The time zone is the last thing left, and it is not
+    // cached either: it costs no request, so re-reading it is free, and it must
+    // never outrank a header that appears on the next pageview.
+    const hint = geoHintFromTimeZone(readBrowserTimeZone());
+    if (!hint) return {
+        country: null,
+        posture: null
+    };
+    // `priorConsent` is honoured directly rather than re-derived from the
+    // country, because the hint's whole point is that it can carry a posture
+    // with no country attached.
+    return {
+        country: hint.country,
+        posture: hint.priorConsent ? 'opt-in' : 'opt-out'
+    };
+}
+/**
+ * `?aglynConsent=ask` simulates a first prior-consent visit.
+ *
+ * Honored on any surface because it only ever moves TOWARD strictness: it can
+ * show someone a banner they have already answered, never strip one and never
+ * un-decline a decline. Choices made under it are stored for real — they are
+ * the visitor's own clicks.
+ */ function hasAskOverride() {
+    try {
+        return new URLSearchParams(window.location.search).get('aglynConsent') === 'ask';
+    } catch (unused) {
+        return false;
+    }
+}
+/**
+ * Resolve this visitor's console consent state, most binding signal first:
+ *
+ * 1. An EXPLICIT stored choice — theirs; keep it, and skip the region lookup.
+ * 2. GPC — the browser's opt-out overrides an implied default (it can arrive
+ *    after one was recorded) but never an explicit accept.
+ * 3. Any other stored record — resolved on a previous visit.
+ * 4. Nothing stored: ask the region endpoint and apply the posture. `opt-out`
+ *    records `implied` and analytics is live from this paint; `opt-in` leaves
+ *    the visitor undecided, which keeps the tag out until the banner gets a
+ *    yes.
+ *
+ * Idempotent: it reads and writes the same storage deterministically and the
+ * region lookup is session-cached, so running it twice costs one network call
+ * and reaches one answer.
+ */ export async function decidePlatformConsent() {
+    var _region_posture;
+    if (typeof window === 'undefined') {
+        return {
+            stored: null,
+            posture: null,
+            country: null
+        };
+    }
+    if (hasAskOverride()) {
+        return {
+            stored: null,
+            posture: 'opt-in',
+            country: null
+        };
+    }
+    let stored = readPlatformConsent();
+    if (hasGlobalPrivacyControl() && !isExplicitConsentStatus(stored == null ? void 0 : stored.status) && (stored == null ? void 0 : stored.status) !== 'gpc-opt-out') {
+        var _ref;
+        stored = storePlatformConsent({
+            status: 'gpc-opt-out',
+            country: (_ref = stored == null ? void 0 : stored.country) != null ? _ref : null
+        });
+    }
+    if (stored) {
+        var _stored_country;
+        return {
+            stored,
+            posture: null,
+            country: (_stored_country = stored.country) != null ? _stored_country : null
+        };
+    }
+    const region = await resolvePlatformConsentRegion();
+    const country = region.country;
+    // The signal's own posture wins where it has one, and only the time-zone
+    // hint sets it — a header names a country and the country decides. Falling
+    // back to `platformConsentPosture(null)` keeps unknown on the strict side.
+    const posture = (_region_posture = region.posture) != null ? _region_posture : platformConsentPosture(country);
+    if (posture === 'opt-out') {
+        return {
+            // Implied consent, recorded as such. `storeVisitorConsent` re-derives
+            // both grants from the status, so the advertising half is whatever this
+            // surface can honestly carry — nothing, while nothing here reads it.
+            stored: storePlatformConsent({
+                status: 'implied',
+                country,
+                advertising: platformAsksAboutAdvertising()
+            }),
+            posture,
+            country
+        };
+    }
+    return {
+        stored: null,
+        posture,
+        country
+    };
+}
+/**
+ * The refusal a "no" means for a visitor in this state.
+ *
+ * `opted-out` when they were defaulted in, `declined` when they were asked
+ * first. Same gate either way; distinct record, because "how many visitors
+ * were tracked before they said no" is a question the two answers separate.
+ */ export function platformRefusalStatus(stored, posture) {
+    return refusalStatusFor(stored, posture);
+}
+/**
+ * Whether a status the panel is about to write would grant analytics — used to
+ * label the control, never to decide the gate.
+ */ export function platformStatusGrantsAnalytics(status) {
+    return analyticsGrantedByStatus(status);
+}
+/**
+ * One-shot guard so a pageview asks the region endpoint once, not once per
+ * render pass.
+ */ const primed = new Set();
+/**
+ * Start the resolution WITHOUT waiting for React to commit.
+ *
+ * The gate component's effect is the normal path and does this too. It is not
+ * enough on its own: an effect only runs if React commits, and a console that
+ * renders but never commits — a suspended provider above the tree — would
+ * otherwise leave a rest-of-world visitor permanently undecided and therefore
+ * permanently unmeasured. Fire-and-forget; the answer lands in storage, so
+ * whenever the component does run it reads it rather than asking again.
+ */ export function primePlatformConsent() {
+    var _ref;
+    var _window_location;
+    if (typeof window === 'undefined') return;
+    const key = String((_ref = (_window_location = window.location) == null ? void 0 : _window_location.pathname) != null ? _ref : '');
+    if (primed.has(key)) return;
+    primed.add(key);
+    void decidePlatformConsent().catch(()=>undefined);
+}
+/** Test seam: forget which pageviews have already been primed. */ export function resetPlatformConsentPriming() {
+    primed.clear();
+    sharesAcrossSubdomains = false;
+}
+
+//# sourceMappingURL=platform-visitor-consent.js.map

package/src/lib/app-utils/platform-visitor-consent.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/platform-visitor-consent.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Visitor consent for AGLYN'S OWN console (`app.aglyn.com`) — the same\n * decision the tenant runtime makes for a customer site, resolved against a\n * surface that has no host document.\n *\n * ## What this module is, and what it deliberately is not\n *\n * It is a COMPOSITION of `visitor-consent.ts`, not a second consent engine.\n * Every question a decision actually turns on is answered there: which\n * statuses grant which category ({@link analyticsGrantedByStatus},\n * {@link advertisingGrantedByStatus}), how a record is read and written\n * ({@link readStoredVisitorConsent}, {@link storeVisitorConsent}), what a\n * withdrawal sweeps, and what consent-mode signals a pair of grants becomes\n * ({@link consentModeSignals}). A second implementation of any of those is how\n * two surfaces come to disagree about whether a visitor said yes, and the\n * disagreement is invisible from either side.\n *\n * What lives here is only what the console answers DIFFERENTLY, and there are\n * exactly three such things:\n *\n * 1. **There is no host document.** A customer site's posture, its gated\n *    categories and its advertising question all come off `hosts/{id}`. The\n *    console has none, so the equivalents are constants derived below from\n *    what this surface actually runs.\n * 2. **The prior-consent region set is the platform's, not the tenant's.**\n *    `PLATFORM_PRIOR_CONSENT_REGIONS` adds Switzerland to the tenant's\n *    ePrivacy set, because Aglyn's own brief treats CH as prior opt-in while\n *    the tenant set stays exactly as customers' sites have it. Reusing that\n *    constant rather than restating a country list is the point — two\n *    hand-kept lists is how one of them ends up a year behind the other.\n * 3. **The storage subject is fixed.** Records are keyed by host id so one\n *    site's yes cannot leak to another's; the console is one surface, so it\n *    takes one constant subject and shares the same `aglyn:consent:` prefix,\n *    the same versioned record shape, and the same reader/writer.\n *\n * ## The posture, which is the tenant's posture\n *\n * - **UK / EU / EEA — and any visitor whose region cannot be determined** —\n *   `opt-in`: nothing non-essential runs until an explicit accept. Undecided\n *   is not a maybe.\n * - **Everywhere else** — `opt-out`: implied consent is recorded on the first\n *   visit, analytics runs from that first paint, and the visitor can withdraw\n *   at any time from the account menu.\n * - **GPC** is honored as an automatic opt-out in both postures, and is\n *   overridden only by a later explicit accept.\n *\n * ## Advertising on this surface\n *\n * Asked about only where something would read the answer — see\n * {@link platformAsksAboutAdvertising}, which derives it from the consent\n * defaults this surface actually declares rather than from a flag someone has\n * to remember to keep in step.\n */\n\nimport {\n  PLATFORM_CONSENT_DEFAULT_COMMANDS,\n  PLATFORM_PRIOR_CONSENT_REGIONS,\n} from './platform-consent-default'\nimport {\n  geoHintFromTimeZone,\n  readBrowserTimeZone,\n} from './timezone-geo-hint'\nimport {\n  analyticsGrantedByStatus,\n  hasGlobalPrivacyControl,\n  isExplicitConsentStatus,\n  readStoredVisitorConsent,\n  refusalStatusFor,\n  registrableCookieDomain,\n  type StoredVisitorConsent,\n  storeVisitorConsent,\n  type VisitorConsentPosture,\n  type VisitorConsentStatus,\n  visitorConsentStorageKey,\n} from './visitor-consent'\n\n/**\n * The storage subject for the console's own consent record.\n *\n * `visitorConsentStorageKey` keys records by host id because preview\n * deployments and localhost serve many customer sites from one origin. The\n * console is a single surface, so it takes a constant — but it takes it\n * through the same key builder, so a console record and a customer-site record\n * can never collide, and a self-hosted console on the same origin as a site\n * keeps its own.\n *\n * A name, not a hostname: the console is served from `app.aglyn.com`, from a\n * custom console domain (AGL-1099c), and from localhost, and a visitor's\n * choice is about the surface rather than about which of its origins they\n * reached it through.\n */\nexport const PLATFORM_CONSENT_SUBJECT = 'aglyn-console'\n\n/**\n * Where the client asks which country it is visiting from.\n *\n * The same path the tenant runtime uses, and for the same reason: the answer\n * is a per-visitor request header, so it cannot be baked into a render. Each\n * app serves its own route handler at this path.\n */\nexport const PLATFORM_CONSENT_REGION_ENDPOINT = '/api/consent/region'\n\n/** Session-scoped region cache — one lookup per visit, not per pageview. */\nexport const PLATFORM_CONSENT_REGION_CACHE_KEY = 'aglyn:consent:region'\n\n/**\n * Whether this surface asks its visitors about advertising storage.\n *\n * DERIVED from {@link PLATFORM_CONSENT_DEFAULT_COMMANDS} rather than declared\n * as its own flag. Those commands are what the console tells gtag about ad\n * storage, so the question and the declaration cannot drift: a surface that\n * denies advertising in every region asks nothing, and one that grants it\n * anywhere asks.\n *\n * A control whose answer changes nothing is decoration, and decoration is what\n * teaches people to click past the controls that do matter — which is the\n * whole reason this is derived rather than hardcoded either way.\n *\n * The console currently grants advertising outside the prior-consent regions,\n * because Aglyn advertises, remarkets and retargets on its own surfaces and\n * the Privacy Policy names this one among them. So the question IS asked, and\n * a visitor who declines gets the signals denied and the tags torn down.\n *\n * `every`, so a single region-scoped grant is enough to make the question\n * real. The console's whole visitor population is not asked about a category\n * because one region's declaration happens to deny it.\n */\nexport function platformAsksAboutAdvertising(): boolean {\n  return !PLATFORM_CONSENT_DEFAULT_COMMANDS.every(\n    (command) => command.ad_storage === 'denied',\n  )\n}\n\n/**\n * The per-visitor posture for the console, from the country the region\n * endpoint reports.\n *\n * Unknown region falls to `opt-in`, exactly as it does for a customer site:\n * the asymmetry is a few lost analytics events on a rare headerless visit,\n * against pre-consent tracking of a European visitor.\n *\n * A separate function from the tenant's `resolveConsentPosture` because it\n * answers over a different country set (see the module comment) — and it reads\n * that set from `platform-consent-default.ts` rather than restating it, so the\n * console's gate and the console's consent-mode declaration can never disagree\n * about which regions require asking first.\n */\nexport function platformConsentPosture(\n  country: string | null | undefined,\n): VisitorConsentPosture {\n  if (!country) return 'opt-in'\n  return PLATFORM_PRIOR_CONSENT_REGIONS.indexOf(country.toUpperCase()) >= 0\n    ? 'opt-in'\n    : 'opt-out'\n}\n\n/**\n * The cookie that carries a console visitor's answer between the sibling\n * subdomains the console is served on.\n *\n * ## The defect this closes\n *\n * `localStorage` is per ORIGIN, and the console is one application served on\n * several hostnames of one registrable domain: `app.<domain>` and\n * `auth.<domain>`, which is where interactive sign-in is delegated to. So a\n * record written on one is invisible to the other.\n *\n * For an accept that is only a second ask — annoying, and fail-safe, since an\n * unread record means untracked. For a REFUSAL it is worse than annoying and\n * not fail-safe at all: outside the prior-consent regions the sibling host\n * finds no record, resolves the posture afresh and writes `implied`, so an\n * explicit opt-out reverts to implied consent on the next hop. A visitor\n * cannot be expected to say no once per hostname of an application they\n * experience as one.\n *\n * ## Why a cookie, and why it carries the whole record\n *\n * A cookie is the only client-side store that spans subdomains, and the\n * consent record is itself strictly necessary storage — it is how a \"no\" is\n * remembered — so it needs no consent of its own. It carries the whole record\n * rather than a flag because the record is what the shared reader validates:\n * the mirror is re-read through `readStoredVisitorConsent`, never trusted, so\n * a hand-edited cookie cannot grant what its status does not.\n */\nexport const PLATFORM_CONSENT_COOKIE = 'aglyn_consent'\n\n/**\n * How long the mirror lives. Thirteen months is the field convention for a\n * consent record and the ceiling several supervisory authorities name; the\n * record's own `at` stamp is what any future re-ask would be judged against.\n */\nconst PLATFORM_CONSENT_COOKIE_MAX_AGE_SECONDS = 13 * 30 * 24 * 60 * 60\n\n/**\n * Whether this origin may share a visitor's answer with its sibling\n * subdomains.\n *\n * OFF by default and switched on by the surface, which is the same polarity\n * `originPersistenceClass` uses and for the same asymmetry. Writing at the\n * registrable domain is only correct where the whole registrable domain is\n * ours: on a CUSTOM console domain it would put our cookie on the customer's\n * apex, beside their own site, on an origin the console is deliberately not\n * allowed to keep durable state on. A surface that says nothing gets a\n * host-only record, which is complete on its own because there are no\n * siblings to disagree with.\n */\nlet sharesAcrossSubdomains = false\n\nexport function setPlatformConsentSharesAcrossSubdomains(\n  shares: boolean,\n): void {\n  sharesAcrossSubdomains = shares\n}\n\n/** The raw mirror value for this browser, or null when there is none. */\nfunction readPlatformConsentMirror(): string | null {\n  if (typeof document === 'undefined') return null\n  try {\n    for (const pair of String(document.cookie ?? '').split(';')) {\n      const cut = pair.indexOf('=')\n      if (cut < 0) continue\n      if (pair.slice(0, cut).trim() !== PLATFORM_CONSENT_COOKIE) continue\n      return decodeURIComponent(pair.slice(cut + 1).trim())\n    }\n  } catch {\n    // Cookies disabled or a hostile `document.cookie`: no mirror, and the\n    // per-origin record still stands.\n  }\n  return null\n}\n\n/**\n * Write the mirror at the registrable domain, so the sibling host can read it.\n *\n * A no-op while sharing is off, and a no-op when the hostname has no\n * registrable domain (`localhost`, an IP literal) — a host-only cookie there\n * would duplicate the localStorage record and carry to nothing.\n */\nfunction writePlatformConsentMirror(stored: StoredVisitorConsent): void {\n  if (!sharesAcrossSubdomains || typeof document === 'undefined') return\n  try {\n    const hostname =\n      typeof window === 'undefined' ? '' : window.location?.hostname\n    const domain = registrableCookieDomain(hostname)\n    if (!domain) return\n    const secure = window.location?.protocol === 'https:' ? '; Secure' : ''\n    document.cookie =\n      `${PLATFORM_CONSENT_COOKIE}=${encodeURIComponent(JSON.stringify(stored))}` +\n      `; Max-Age=${PLATFORM_CONSENT_COOKIE_MAX_AGE_SECONDS}` +\n      `; Path=/; Domain=.${domain}; SameSite=Lax${secure}`\n  } catch {\n    // A refusal to write the mirror costs the carry-over, never the decision:\n    // the per-origin record is already stored by the caller.\n  }\n}\n\n/**\n * Adopt a sibling host's answer into this origin, if this origin has none.\n *\n * Called ONCE at boot rather than from {@link readPlatformConsent}, because\n * that reader is consulted synchronously from the analytics gate — during the\n * services provider's first render, and again on every consent change — and a\n * reader with a write in it would put a storage write in a render path and\n * repeat it forever. Boot is also early enough by construction: module scope\n * runs before the first render, so the gate's first read already sees it.\n *\n * The value is written into localStorage and then read back through\n * {@link readPlatformConsent}, which is the whole reason this is safe. The\n * shared reader re-derives both grants from the status and rejects an\n * unrecognized shape, so a hand-edited cookie can only ever produce a record\n * the status supports — the same guarantee the per-origin path has.\n *\n * Returns whether a record was adopted, which is what makes it assertable.\n */\nexport function hydratePlatformConsentFromMirror(): boolean {\n  if (!sharesAcrossSubdomains || typeof window === 'undefined') return false\n  // This origin's own answer always wins. It is the more recent statement by\n  // definition — a decision made here is mirrored outward on the way in.\n  if (readStoredVisitorConsent(PLATFORM_CONSENT_SUBJECT)) return false\n  const raw = readPlatformConsentMirror()\n  if (!raw) return false\n  try {\n    window.localStorage.setItem(\n      visitorConsentStorageKey(PLATFORM_CONSENT_SUBJECT),\n      raw,\n    )\n  } catch {\n    // Private mode: no adoption, and the visitor is asked again on this host.\n    return false\n  }\n  // Validated, not assumed: a cookie whose shape or status the shared reader\n  // refuses leaves this origin with nothing, which is the undecided state.\n  if (readStoredVisitorConsent(PLATFORM_CONSENT_SUBJECT)) return true\n  try {\n    // …and the refused value does not stay behind. The reader already answers\n    // null for it, but a key holding something unreadable is what the next\n    // person debugging this will find and believe.\n    window.localStorage.removeItem(\n      visitorConsentStorageKey(PLATFORM_CONSENT_SUBJECT),\n    )\n  } catch {\n    // Nothing to clean up if storage is refusing us.\n  }\n  return false\n}\n\n/** The console visitor's stored record, or null when there is none. */\nexport function readPlatformConsent(): StoredVisitorConsent | null {\n  return readStoredVisitorConsent(PLATFORM_CONSENT_SUBJECT)\n}\n\n/**\n * Record a console consent state.\n *\n * Delegates wholesale, which is what carries the withdrawal behaviour: the\n * shared writer re-derives both grants from the status, silences any resident\n * GA tag, sweeps the analytics and advertising cookies, drops the persistent\n * visitor id, and dispatches `VISITOR_CONSENT_CHANGED_EVENT`. The console's\n * analytics gate listens for that event, which is what makes a refusal act on\n * this pageview instead of the next one.\n */\nexport function storePlatformConsent(state: {\n  status: VisitorConsentStatus\n  country?: string | null\n  advertising?: boolean\n}): StoredVisitorConsent {\n  const stored = storeVisitorConsent(PLATFORM_CONSENT_SUBJECT, state)\n  // Mirrored on EVERY decision, including the refusals. A mirror that only\n  // carried grants would leave the worst case uncovered: an explicit opt-out\n  // on one host, then the sibling host finding nothing and writing `implied`\n  // from the posture — which is the visitor's refusal being overturned by a\n  // hop they did not make.\n  writePlatformConsentMirror(stored)\n  return stored\n}\n\n/**\n * The gate's whole verdict: may analytics run for this console visitor right\n * now?\n *\n * Reads storage on every call rather than caching, because it is consulted\n * synchronously from the Firebase services boot — before any effect has run,\n * and again after a consent change — and a cached answer is exactly how a\n * withdrawal fails to take effect until a reload.\n *\n * Absent record answers NO. That is the load-bearing half: an undecided\n * visitor is a visitor the tag stays out of, whatever the reason for their\n * being undecided, so the gate never has to ask WHY.\n */\nexport function platformAnalyticsAllowed(): boolean {\n  return readPlatformConsent()?.analytics === true\n}\n\n/** Whether advertising storage may run for this console visitor. */\nexport function platformAdvertisingAllowed(): boolean {\n  if (!platformAsksAboutAdvertising()) return false\n  return readPlatformConsent()?.advertising === true\n}\n\n/** The console's resolution of a visitor, with no React in it. */\nexport interface ResolvedPlatformConsent {\n  stored: StoredVisitorConsent | null\n  posture: VisitorConsentPosture | null\n  country: string | null\n}\n\n/**\n * The country this visitor is in, or null when nothing can name one.\n *\n * The country half of {@link resolvePlatformConsentRegion}, kept because a\n * caller that only wants a country should not have to know that a posture can\n * arrive without one.\n */\nexport async function resolvePlatformConsentCountry(): Promise<string | null> {\n  return (await resolvePlatformConsentRegion()).country\n}\n\n/**\n * The region signal for this visit: a country when anything can name one, and\n * a posture when the only signal available carries one without a country.\n *\n * Three sources, in strict order of authority, and the order is the whole\n * design:\n *\n * 1. **The session cache** — a country already resolved this visit.\n * 2. **The region endpoint** — an edge header, which is the only source that\n *    knows where the request actually came from.\n * 3. **The browser's time zone** — {@link geoHintFromTimeZone}, and ONLY when\n *    the first two produced nothing. It exists for a deployment with no geo\n *    header at all: a self-hosted container behind a plain reverse proxy,\n *    where every visitor would otherwise be treated as unlocatable and asked\n *    to opt in. It is never consulted while a header answers, and a zone it\n *    does not recognize (`null`) is treated exactly as a missing header —\n *    strictest posture, never permission.\n */\nexport interface ResolvedConsentRegion {\n  /** The country, when a source could honestly name one. */\n  country: string | null\n  /**\n   * A posture the country cannot express, or null to derive it from the\n   * country. Set only by the time-zone hint, which can say \"not a\n   * prior-consent region\" while refusing to name which country that is —\n   * `America/Chicago` is the United States in almost every case and is also\n   * Canadian and Mexican territory in places, and a country that is merely\n   * probable is worse on a stored record than an absent one.\n   */\n  posture: VisitorConsentPosture | null\n}\n\n/**\n * The lookup that is CURRENTLY IN FLIGHT, shared by every caller that arrives\n * while it is (AGL-2710).\n *\n * The session cache is written when the response lands, so on its own it\n * dedupes a later pageview and nothing sooner: two components that both want\n * the region during the same hydration both miss it and both ask. Released\n * once the promise settles, so the \"only a resolved country is cached, a\n * failure is re-asked\" rule below is untouched — this shares one request, it\n * does not remember an answer.\n */\nlet platformRegionInFlight: Promise<ResolvedConsentRegion> | null = null\n\nexport async function resolvePlatformConsentRegion(): Promise<ResolvedConsentRegion> {\n  if (typeof window === 'undefined') return { country: null, posture: null }\n  try {\n    const cached = window.sessionStorage.getItem(\n      PLATFORM_CONSENT_REGION_CACHE_KEY,\n    )\n    if (cached) {\n      const parsed = JSON.parse(cached)\n      // A cached entry counts only when it NAMES a country. Anything else —\n      // including `{\"country\":null}` written by a build from before this rule\n      // — is treated as a miss, which is what lets a tab that cached a failure\n      // heal itself on the next pageview instead of carrying it to the end of\n      // the session.\n      if (typeof parsed?.country === 'string' && parsed.country) {\n        return { country: parsed.country, posture: null }\n      }\n    }\n  } catch {\n    // No storage — ask every pageview; correct, just less frugal.\n  }\n  if (platformRegionInFlight) return platformRegionInFlight\n  const pending = askPlatformConsentRegion().finally(() => {\n    if (platformRegionInFlight === pending) platformRegionInFlight = null\n  })\n  platformRegionInFlight = pending\n  return pending\n}\n\nasync function askPlatformConsentRegion(): Promise<ResolvedConsentRegion> {\n  let country: string | null = null\n  try {\n    const response = await fetch(PLATFORM_CONSENT_REGION_ENDPOINT)\n    if (response.ok) {\n      const payload = await response.json().catch((): null => null)\n      country = typeof payload?.country === 'string' ? payload.country : null\n    }\n  } catch {\n    // Network failure reads as no signal, which falls through exactly as an\n    // absent header does.\n  }\n  if (country) {\n    try {\n      // ONLY a resolved country is cached, and the asymmetry is the point. A\n      // cached country is a fact; a cached absence is a FAILURE, and caching a\n      // failure pins the outcome that failure produces. One cold edge, one\n      // request that skipped the proxy, and the visitor would spend the rest\n      // of the session on the strictest posture with nothing re-asking — a\n      // banner they cannot get rid of, and analytics that never resume.\n      window.sessionStorage.setItem(\n        PLATFORM_CONSENT_REGION_CACHE_KEY,\n        JSON.stringify({ country }),\n      )\n    } catch {\n      // Best-effort cache only.\n    }\n    return { country, posture: null }\n  }\n  // No header anywhere. The time zone is the last thing left, and it is not\n  // cached either: it costs no request, so re-reading it is free, and it must\n  // never outrank a header that appears on the next pageview.\n  const hint = geoHintFromTimeZone(readBrowserTimeZone())\n  if (!hint) return { country: null, posture: null }\n  // `priorConsent` is honoured directly rather than re-derived from the\n  // country, because the hint's whole point is that it can carry a posture\n  // with no country attached.\n  return {\n    country: hint.country,\n    posture: hint.priorConsent ? 'opt-in' : 'opt-out',\n  }\n}\n\n/**\n * `?aglynConsent=ask` simulates a first prior-consent visit.\n *\n * Honored on any surface because it only ever moves TOWARD strictness: it can\n * show someone a banner they have already answered, never strip one and never\n * un-decline a decline. Choices made under it are stored for real — they are\n * the visitor's own clicks.\n */\nfunction hasAskOverride(): boolean {\n  try {\n    return (\n      new URLSearchParams(window.location.search).get('aglynConsent') === 'ask'\n    )\n  } catch {\n    return false\n  }\n}\n\n/**\n * Resolve this visitor's console consent state, most binding signal first:\n *\n * 1. An EXPLICIT stored choice — theirs; keep it, and skip the region lookup.\n * 2. GPC — the browser's opt-out overrides an implied default (it can arrive\n *    after one was recorded) but never an explicit accept.\n * 3. Any other stored record — resolved on a previous visit.\n * 4. Nothing stored: ask the region endpoint and apply the posture. `opt-out`\n *    records `implied` and analytics is live from this paint; `opt-in` leaves\n *    the visitor undecided, which keeps the tag out until the banner gets a\n *    yes.\n *\n * Idempotent: it reads and writes the same storage deterministically and the\n * region lookup is session-cached, so running it twice costs one network call\n * and reaches one answer.\n */\nexport async function decidePlatformConsent(): Promise<ResolvedPlatformConsent> {\n  if (typeof window === 'undefined') {\n    return { stored: null, posture: null, country: null }\n  }\n  if (hasAskOverride()) {\n    return { stored: null, posture: 'opt-in', country: null }\n  }\n  let stored = readPlatformConsent()\n  if (\n    hasGlobalPrivacyControl() &&\n    !isExplicitConsentStatus(stored?.status) &&\n    stored?.status !== 'gpc-opt-out'\n  ) {\n    stored = storePlatformConsent({\n      status: 'gpc-opt-out',\n      country: stored?.country ?? null,\n    })\n  }\n  if (stored) {\n    return { stored, posture: null, country: stored.country ?? null }\n  }\n  const region = await resolvePlatformConsentRegion()\n  const country = region.country\n  // The signal's own posture wins where it has one, and only the time-zone\n  // hint sets it — a header names a country and the country decides. Falling\n  // back to `platformConsentPosture(null)` keeps unknown on the strict side.\n  const posture = region.posture ?? platformConsentPosture(country)\n  if (posture === 'opt-out') {\n    return {\n      // Implied consent, recorded as such. `storeVisitorConsent` re-derives\n      // both grants from the status, so the advertising half is whatever this\n      // surface can honestly carry — nothing, while nothing here reads it.\n      stored: storePlatformConsent({\n        status: 'implied',\n        country,\n        advertising: platformAsksAboutAdvertising(),\n      }),\n      posture,\n      country,\n    }\n  }\n  return { stored: null, posture, country }\n}\n\n/**\n * The refusal a \"no\" means for a visitor in this state.\n *\n * `opted-out` when they were defaulted in, `declined` when they were asked\n * first. Same gate either way; distinct record, because \"how many visitors\n * were tracked before they said no\" is a question the two answers separate.\n */\nexport function platformRefusalStatus(\n  stored: StoredVisitorConsent | null,\n  posture: VisitorConsentPosture | null,\n): VisitorConsentStatus {\n  return refusalStatusFor(stored, posture)\n}\n\n/**\n * Whether a status the panel is about to write would grant analytics — used to\n * label the control, never to decide the gate.\n */\nexport function platformStatusGrantsAnalytics(\n  status: VisitorConsentStatus,\n): boolean {\n  return analyticsGrantedByStatus(status)\n}\n\n/**\n * One-shot guard so a pageview asks the region endpoint once, not once per\n * render pass.\n */\nconst primed = new Set<string>()\n\n/**\n * Start the resolution WITHOUT waiting for React to commit.\n *\n * The gate component's effect is the normal path and does this too. It is not\n * enough on its own: an effect only runs if React commits, and a console that\n * renders but never commits — a suspended provider above the tree — would\n * otherwise leave a rest-of-world visitor permanently undecided and therefore\n * permanently unmeasured. Fire-and-forget; the answer lands in storage, so\n * whenever the component does run it reads it rather than asking again.\n */\nexport function primePlatformConsent(): void {\n  if (typeof window === 'undefined') return\n  const key = String(window.location?.pathname ?? '')\n  if (primed.has(key)) return\n  primed.add(key)\n  void decidePlatformConsent().catch((): undefined => undefined)\n}\n\n/** Test seam: forget which pageviews have already been primed. */\nexport function resetPlatformConsentPriming(): void {\n  primed.clear()\n  sharesAcrossSubdomains = false\n}\n"],"names":["PLATFORM_CONSENT_DEFAULT_COMMANDS","PLATFORM_PRIOR_CONSENT_REGIONS","geoHintFromTimeZone","readBrowserTimeZone","analyticsGrantedByStatus","hasGlobalPrivacyControl","isExplicitConsentStatus","readStoredVisitorConsent","refusalStatusFor","registrableCookieDomain","storeVisitorConsent","visitorConsentStorageKey","PLATFORM_CONSENT_SUBJECT","PLATFORM_CONSENT_REGION_ENDPOINT","PLATFORM_CONSENT_REGION_CACHE_KEY","platformAsksAboutAdvertising","every","command","ad_storage","platformConsentPosture","country","indexOf","toUpperCase","PLATFORM_CONSENT_COOKIE","PLATFORM_CONSENT_COOKIE_MAX_AGE_SECONDS","sharesAcrossSubdomains","setPlatformConsentSharesAcrossSubdomains","shares","readPlatformConsentMirror","document","pair","String","cookie","split","cut","slice","trim","decodeURIComponent","writePlatformConsentMirror","stored","window","hostname","location","domain","secure","protocol","encodeURIComponent","JSON","stringify","hydratePlatformConsentFromMirror","raw","localStorage","setItem","removeItem","readPlatformConsent","storePlatformConsent","state","platformAnalyticsAllowed","analytics","platformAdvertisingAllowed","advertising","resolvePlatformConsentCountry","resolvePlatformConsentRegion","platformRegionInFlight","posture","cached","sessionStorage","getItem","parsed","parse","pending","askPlatformConsentRegion","finally","response","fetch","ok","payload","json","catch","hint","priorConsent","hasAskOverride","URLSearchParams","search","get","decidePlatformConsent","region","status","platformRefusalStatus","platformStatusGrantsAnalytics","primed","Set","primePlatformConsent","key","pathname","has","add","undefined","resetPlatformConsentPriming","clear"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoDC,GAED,SACEA,iCAAiC,EACjCC,8BAA8B,QACzB,gCAA4B;AACnC,SACEC,mBAAmB,EACnBC,mBAAmB,QACd,yBAAqB;AAC5B,SACEC,wBAAwB,EACxBC,uBAAuB,EACvBC,uBAAuB,EACvBC,wBAAwB,EACxBC,gBAAgB,EAChBC,uBAAuB,EAEvBC,mBAAmB,EAGnBC,wBAAwB,QACnB,uBAAmB;AAE1B;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMC,2BAA2B,gBAAe;AAEvD;;;;;;CAMC,GACD,OAAO,MAAMC,mCAAmC,sBAAqB;AAErE,0EAA0E,GAC1E,OAAO,MAAMC,oCAAoC,uBAAsB;AAEvE;;;;;;;;;;;;;;;;;;;;;CAqBC,GACD,OAAO,SAASC;IACd,OAAO,CAACf,kCAAkCgB,KAAK,CAC7C,CAACC,UAAYA,QAAQC,UAAU,KAAK;AAExC;AAEA;;;;;;;;;;;;;CAaC,GACD,OAAO,SAASC,uBACdC,OAAkC;IAElC,IAAI,CAACA,SAAS,OAAO;IACrB,OAAOnB,+BAA+BoB,OAAO,CAACD,QAAQE,WAAW,OAAO,IACpE,WACA;AACN;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BC,GACD,OAAO,MAAMC,0BAA0B,gBAAe;AAEtD;;;;CAIC,GACD,MAAMC,0CAA0C,KAAK,KAAK,KAAK,KAAK;AAEpE;;;;;;;;;;;;CAYC,GACD,IAAIC,yBAAyB;AAE7B,OAAO,SAASC,yCACdC,MAAe;IAEfF,yBAAyBE;AAC3B;AAEA,uEAAuE,GACvE,SAASC;IACP,IAAI,OAAOC,aAAa,aAAa,OAAO;IAC5C,IAAI;YACwBA;QAA1B,KAAK,MAAMC,QAAQC,QAAOF,mBAAAA,SAASG,MAAM,YAAfH,mBAAmB,IAAII,KAAK,CAAC,KAAM;YAC3D,MAAMC,MAAMJ,KAAKT,OAAO,CAAC;YACzB,IAAIa,MAAM,GAAG;YACb,IAAIJ,KAAKK,KAAK,CAAC,GAAGD,KAAKE,IAAI,OAAOb,yBAAyB;YAC3D,OAAOc,mBAAmBP,KAAKK,KAAK,CAACD,MAAM,GAAGE,IAAI;QACpD;IACF,EAAE,eAAM;IACN,sEAAsE;IACtE,kCAAkC;IACpC;IACA,OAAO;AACT;AAEA;;;;;;CAMC,GACD,SAASE,2BAA2BC,MAA4B;IAC9D,IAAI,CAACd,0BAA0B,OAAOI,aAAa,aAAa;IAChE,IAAI;YAEqCW,kBAGxBA;QAJf,MAAMC,WACJ,OAAOD,WAAW,cAAc,MAAKA,mBAAAA,OAAOE,QAAQ,qBAAfF,iBAAiBC,QAAQ;QAChE,MAAME,SAASlC,wBAAwBgC;QACvC,IAAI,CAACE,QAAQ;QACb,MAAMC,SAASJ,EAAAA,oBAAAA,OAAOE,QAAQ,qBAAfF,kBAAiBK,QAAQ,MAAK,WAAW,aAAa;QACrEhB,SAASG,MAAM,GACb,GAAGT,wBAAwB,CAAC,EAAEuB,mBAAmBC,KAAKC,SAAS,CAACT,UAAU,GAC1E,CAAC,UAAU,EAAEf,yCAAyC,GACtD,CAAC,kBAAkB,EAAEmB,OAAO,cAAc,EAAEC,QAAQ;IACxD,EAAE,eAAM;IACN,0EAA0E;IAC1E,yDAAyD;IAC3D;AACF;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,SAASK;IACd,IAAI,CAACxB,0BAA0B,OAAOe,WAAW,aAAa,OAAO;IACrE,2EAA2E;IAC3E,uEAAuE;IACvE,IAAIjC,yBAAyBK,2BAA2B,OAAO;IAC/D,MAAMsC,MAAMtB;IACZ,IAAI,CAACsB,KAAK,OAAO;IACjB,IAAI;QACFV,OAAOW,YAAY,CAACC,OAAO,CACzBzC,yBAAyBC,2BACzBsC;IAEJ,EAAE,eAAM;QACN,0EAA0E;QAC1E,OAAO;IACT;IACA,2EAA2E;IAC3E,yEAAyE;IACzE,IAAI3C,yBAAyBK,2BAA2B,OAAO;IAC/D,IAAI;QACF,0EAA0E;QAC1E,uEAAuE;QACvE,+CAA+C;QAC/C4B,OAAOW,YAAY,CAACE,UAAU,CAC5B1C,yBAAyBC;IAE7B,EAAE,eAAM;IACN,iDAAiD;IACnD;IACA,OAAO;AACT;AAEA,qEAAqE,GACrE,OAAO,SAAS0C;IACd,OAAO/C,yBAAyBK;AAClC;AAEA;;;;;;;;;CASC,GACD,OAAO,SAAS2C,qBAAqBC,KAIpC;IACC,MAAMjB,SAAS7B,oBAAoBE,0BAA0B4C;IAC7D,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,yBAAyB;IACzBlB,2BAA2BC;IAC3B,OAAOA;AACT;AAEA;;;;;;;;;;;;CAYC,GACD,OAAO,SAASkB;QACPH;IAAP,OAAOA,EAAAA,uBAAAA,0CAAAA,qBAAuBI,SAAS,MAAK;AAC9C;AAEA,kEAAkE,GAClE,OAAO,SAASC;QAEPL;IADP,IAAI,CAACvC,gCAAgC,OAAO;IAC5C,OAAOuC,EAAAA,uBAAAA,0CAAAA,qBAAuBM,WAAW,MAAK;AAChD;AASA;;;;;;CAMC,GACD,OAAO,eAAeC;IACpB,OAAO,AAAC,CAAA,MAAMC,8BAA6B,EAAG1C,OAAO;AACvD;AAkCA;;;;;;;;;;CAUC,GACD,IAAI2C,yBAAgE;AAEpE,OAAO,eAAeD;IACpB,IAAI,OAAOtB,WAAW,aAAa,OAAO;QAAEpB,SAAS;QAAM4C,SAAS;IAAK;IACzE,IAAI;QACF,MAAMC,SAASzB,OAAO0B,cAAc,CAACC,OAAO,CAC1CrD;QAEF,IAAImD,QAAQ;YACV,MAAMG,SAASrB,KAAKsB,KAAK,CAACJ;YAC1B,sEAAsE;YACtE,wEAAwE;YACxE,yEAAyE;YACzE,wEAAwE;YACxE,eAAe;YACf,IAAI,QAAOG,0BAAAA,OAAQhD,OAAO,MAAK,YAAYgD,OAAOhD,OAAO,EAAE;gBACzD,OAAO;oBAAEA,SAASgD,OAAOhD,OAAO;oBAAE4C,SAAS;gBAAK;YAClD;QACF;IACF,EAAE,eAAM;IACN,8DAA8D;IAChE;IACA,IAAID,wBAAwB,OAAOA;IACnC,MAAMO,UAAUC,2BAA2BC,OAAO,CAAC;QACjD,IAAIT,2BAA2BO,SAASP,yBAAyB;IACnE;IACAA,yBAAyBO;IACzB,OAAOA;AACT;AAEA,eAAeC;IACb,IAAInD,UAAyB;IAC7B,IAAI;QACF,MAAMqD,WAAW,MAAMC,MAAM7D;QAC7B,IAAI4D,SAASE,EAAE,EAAE;YACf,MAAMC,UAAU,MAAMH,SAASI,IAAI,GAAGC,KAAK,CAAC,IAAY;YACxD1D,UAAU,QAAOwD,2BAAAA,QAASxD,OAAO,MAAK,WAAWwD,QAAQxD,OAAO,GAAG;QACrE;IACF,EAAE,eAAM;IACN,wEAAwE;IACxE,sBAAsB;IACxB;IACA,IAAIA,SAAS;QACX,IAAI;YACF,uEAAuE;YACvE,yEAAyE;YACzE,qEAAqE;YACrE,uEAAuE;YACvE,qEAAqE;YACrE,kEAAkE;YAClEoB,OAAO0B,cAAc,CAACd,OAAO,CAC3BtC,mCACAiC,KAAKC,SAAS,CAAC;gBAAE5B;YAAQ;QAE7B,EAAE,eAAM;QACN,0BAA0B;QAC5B;QACA,OAAO;YAAEA;YAAS4C,SAAS;QAAK;IAClC;IACA,0EAA0E;IAC1E,4EAA4E;IAC5E,4DAA4D;IAC5D,MAAMe,OAAO7E,oBAAoBC;IACjC,IAAI,CAAC4E,MAAM,OAAO;QAAE3D,SAAS;QAAM4C,SAAS;IAAK;IACjD,sEAAsE;IACtE,yEAAyE;IACzE,4BAA4B;IAC5B,OAAO;QACL5C,SAAS2D,KAAK3D,OAAO;QACrB4C,SAASe,KAAKC,YAAY,GAAG,WAAW;IAC1C;AACF;AAEA;;;;;;;CAOC,GACD,SAASC;IACP,IAAI;QACF,OACE,IAAIC,gBAAgB1C,OAAOE,QAAQ,CAACyC,MAAM,EAAEC,GAAG,CAAC,oBAAoB;IAExE,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,eAAeC;QA0BJC;IAzBhB,IAAI,OAAO9C,WAAW,aAAa;QACjC,OAAO;YAAED,QAAQ;YAAMyB,SAAS;YAAM5C,SAAS;QAAK;IACtD;IACA,IAAI6D,kBAAkB;QACpB,OAAO;YAAE1C,QAAQ;YAAMyB,SAAS;YAAU5C,SAAS;QAAK;IAC1D;IACA,IAAImB,SAASe;IACb,IACEjD,6BACA,CAACC,wBAAwBiC,0BAAAA,OAAQgD,MAAM,KACvChD,CAAAA,0BAAAA,OAAQgD,MAAM,MAAK,eACnB;;QACAhD,SAASgB,qBAAqB;YAC5BgC,QAAQ;YACRnE,OAAO,UAAEmB,0BAAAA,OAAQnB,OAAO,mBAAI;QAC9B;IACF;IACA,IAAImB,QAAQ;YAC+BA;QAAzC,OAAO;YAAEA;YAAQyB,SAAS;YAAM5C,OAAO,GAAEmB,kBAAAA,OAAOnB,OAAO,YAAdmB,kBAAkB;QAAK;IAClE;IACA,MAAM+C,SAAS,MAAMxB;IACrB,MAAM1C,UAAUkE,OAAOlE,OAAO;IAC9B,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM4C,WAAUsB,kBAAAA,OAAOtB,OAAO,YAAdsB,kBAAkBnE,uBAAuBC;IACzD,IAAI4C,YAAY,WAAW;QACzB,OAAO;YACL,sEAAsE;YACtE,wEAAwE;YACxE,qEAAqE;YACrEzB,QAAQgB,qBAAqB;gBAC3BgC,QAAQ;gBACRnE;gBACAwC,aAAa7C;YACf;YACAiD;YACA5C;QACF;IACF;IACA,OAAO;QAAEmB,QAAQ;QAAMyB;QAAS5C;IAAQ;AAC1C;AAEA;;;;;;CAMC,GACD,OAAO,SAASoE,sBACdjD,MAAmC,EACnCyB,OAAqC;IAErC,OAAOxD,iBAAiB+B,QAAQyB;AAClC;AAEA;;;CAGC,GACD,OAAO,SAASyB,8BACdF,MAA4B;IAE5B,OAAOnF,yBAAyBmF;AAClC;AAEA;;;CAGC,GACD,MAAMG,SAAS,IAAIC;AAEnB;;;;;;;;;CASC,GACD,OAAO,SAASC;;QAEKpD;IADnB,IAAI,OAAOA,WAAW,aAAa;IACnC,MAAMqD,MAAM9D,gBAAOS,mBAAAA,OAAOE,QAAQ,qBAAfF,iBAAiBsD,QAAQ,mBAAI;IAChD,IAAIJ,OAAOK,GAAG,CAACF,MAAM;IACrBH,OAAOM,GAAG,CAACH;IACX,KAAKR,wBAAwBP,KAAK,CAAC,IAAiBmB;AACtD;AAEA,gEAAgE,GAChE,OAAO,SAASC;IACdR,OAAOS,KAAK;IACZ1E,yBAAyB;AAC3B"}